# API authentication

Date: 2026-08-20

Date: 2026-08-22

## Account API clients

Create a token at `/settings/api-tokens`. Manual tokens carry `account:write`

and `forge:write`, do not expire by default, and act with the issuing account's

authority. You can select a 7-, 30-, or 90-day lifetime when a client requires

rotation. The `oa_pat_…` plaintext appears once; OpenAgents stores only its

SHA-256 digest.

Use `account:write` to call the same chat runtime that serves `/chat`:

```sh

curl https://openagents.com/api/v1/chat/responses \

  --header "Authorization: Bearer $OPENAGENTS_API_TOKEN" \

  --header "Content-Type: application/json" \

  --data '{"input":"Read my repository README.","reasoning":{"effort":"high"}}'

```

Set `"stream":true` to receive server-sent events for reasoning, tool calls,

tool results, response text, and terminal completion. The server selects the

model and tools. The token supplies the account identity, so a caller cannot

claim another user's repository authority.

## Forge API clients

Every `POST`, `PUT`, `PATCH`, and `DELETE` route under `/api/v3` requires an

OpenAgents personal API token with exact `forge:write` scope.

Create a token in the authenticated browser at `/settings/api-tokens`. Choose a

name and a lifetime from 1 through 90 days. The `oa_pat_…` plaintext appears

once; OpenAgents stores only its SHA-256 digest. Send it as a bearer:

Send a token with `forge:write` as a bearer:

```sh

curl \

defmodule OpenAgents.ApiTokens do

  @moduledoc "Scoped, expiring first-party credentials for non-browser API clients."

  @moduledoc "Scoped first-party credentials for non-browser API clients."

  import Ecto.Query

  alias OpenAgents.Repo

  @prefix "oa_pat_"

  @allowed_scopes ["forge:write"]

  @allowed_scopes ["account:write", "forge:write"]

  @maximum_lifetime_days 90

  @spec create(User.t(), map()) ::

  def create(%User{id: user_id}, attributes) when is_map(attributes) do

    with {:ok, name} <- name(attributes),

         {:ok, scopes} <- scopes(attributes),

         {:ok, lifetime_days} <- lifetime_days(attributes) do

         {:ok, expires_at} <- expires_at(attributes) do

      id = Ecto.UUID.generate()

      secret = Base.url_encode64(:crypto.strong_rand_bytes(32), padding: false)

      plaintext = @prefix <> id <> "." <> secret

          |> ApiToken.create_changeset(%{

            name: name,

            scopes: scopes,

            expires_at: DateTime.add(DateTime.utc_now(), lifetime_days, :day)

            expires_at: expires_at

          })

          |> Repo.insert!()

  defp usable?(token, required_scope) do

    is_nil(token.revoked_at) and required_scope in token.scopes and

      DateTime.compare(DateTime.utc_now(), token.expires_at) == :lt

      (is_nil(token.expires_at) or DateTime.compare(DateTime.utc_now(), token.expires_at) == :lt)

  end

  defp name(attributes) do

    end

  end

  defp lifetime_days(attributes) do

    case Map.get(attributes, "lifetime_days") || Map.get(attributes, :lifetime_days) || 30 do

      days when is_integer(days) and days in 1..@maximum_lifetime_days -> {:ok, days}

      days when is_binary(days) -> parse_lifetime_days(days)

      _invalid -> {:error, :invalid_api_token}

  defp expires_at(attributes) do

    case Map.get(attributes, "lifetime_days") || Map.get(attributes, :lifetime_days) do

      nil ->

        {:ok, nil}

      "" ->

        {:ok, nil}

      "never" ->

        {:ok, nil}

      days when is_integer(days) and days in 1..@maximum_lifetime_days ->

        {:ok, DateTime.add(DateTime.utc_now(), days, :day)}

      days when is_binary(days) ->

        parse_expiry(days)

      _invalid ->

        {:error, :invalid_api_token}

    end

  end

  defp parse_lifetime_days(value) do

  defp parse_expiry(value) do

    case Integer.parse(value) do

      {days, ""} when days in 1..@maximum_lifetime_days -> {:ok, days}

      _invalid -> {:error, :invalid_api_token}

      {days, ""} when days in 1..@maximum_lifetime_days ->

        {:ok, DateTime.add(DateTime.utc_now(), days, :day)}

      _invalid ->

        {:error, :invalid_api_token}

    end

  end

  def create_changeset(token, attributes) do

    token

    |> cast(attributes, [:name, :scopes, :expires_at])

    |> validate_required([:name, :scopes, :expires_at])

    |> validate_required([:name, :scopes])

    |> validate_length(:name, min: 1, max: 80)

    |> validate_length(:scopes, min: 1, max: 8)

    |> check_constraint(:scopes, name: :api_tokens_scopes_present)

defmodule OpenAgents.Chat.Runner do

  @moduledoc "Runs account-scoped chat requests for both LiveView and API clients."

  alias OpenAgents.Chat.OpenRouter

  @fallback_models ["openrouter/free"]

  @maximum_messages 100

  @maximum_content_bytes 128_000

  @spec request([map()], String.t(), String.t()) :: map()

  def request(history, message, reasoning) do

    %{

      "model" => OpenRouter.default_model(),

      "models" => @fallback_models,

      "reasoning" => OpenRouter.reasoning_effort(reasoning),

      "messages" =>

        Enum.map(history, &provider_message/1) ++ [%{"role" => "user", "content" => message}]

    }

  end

  @spec request_from_params(map()) :: {:ok, map()} | {:error, atom()}

  def request_from_params(params) when is_map(params) do

    with {:ok, messages} <- messages(params),

         :ok <- validate_messages(messages) do

      reasoning = reasoning(params)

      {:ok,

       %{

         "model" => OpenRouter.default_model(),

         "models" => @fallback_models,

         "reasoning" => reasoning,

         "messages" => messages

       }}

    end

  end

  @spec stream(map(), OpenAgents.Accounts.User.t(), (tuple() -> any()), keyword()) ::

          {:ok, map()} | {:error, term()}

  def stream(request, user, on_event, options \\ []) do

    provider = Keyword.get(options, :provider, configured_provider())

    provider.stream(request, on_event, Keyword.put(options, :tool_context, %{user: user}))

  end

  defp configured_provider,

    do: Application.get_env(:openagents, :chat_provider, OpenRouter)

  defp messages(%{"messages" => messages}) when is_list(messages), do: {:ok, messages}

  defp messages(%{"input" => input}) when is_binary(input),

    do: {:ok, [%{"role" => "user", "content" => input}]}

  defp messages(%{"input" => input}) when is_list(input), do: {:ok, input}

  defp messages(_params), do: {:error, :invalid_input}

  defp validate_messages(messages) when length(messages) in 1..@maximum_messages do

    valid? =

      Enum.all?(messages, fn

        %{"role" => role, "content" => content}

        when role in ["system", "user", "assistant"] and is_binary(content) ->

          byte_size(content) <= @maximum_content_bytes

        _invalid ->

          false

      end)

    if valid?, do: :ok, else: {:error, :invalid_input}

  end

  defp validate_messages(_messages), do: {:error, :invalid_input}

  defp reasoning(%{"reasoning" => %{"effort" => effort}}),

    do: OpenRouter.reasoning_effort(effort)

  defp reasoning(%{"reasoning" => effort}) when is_binary(effort),

    do: OpenRouter.reasoning_effort(effort)

  defp reasoning(_params), do: "high"

  defp provider_message(%{role: :assistant} = message) do

    %{"role" => "assistant", "content" => message.content}

    |> maybe_put("id", Map.get(message, :provider_message_id))

    |> maybe_put("status", Map.get(message, :provider_status))

    |> maybe_put_list("reasoning_items", Map.get(message, :provider_reasoning_items))

  end

  defp provider_message(%{role: role, content: content}),

    do: %{"role" => Atom.to_string(role), "content" => content}

  defp provider_message(%{"role" => _role, "content" => _content} = message), do: message

  defp maybe_put(message, _key, nil), do: message

  defp maybe_put(message, key, value), do: Map.put(message, key, value)

  defp maybe_put_list(message, key, values) when is_list(values) and values != [],

    do: Map.put(message, key, values)

  defp maybe_put_list(message, _key, _values), do: message

end

  end

  def create(conn, params) do

    params =

      if Map.has_key?(params, "scopes") or Map.has_key?(params, :scopes) do

        params

      else

        Map.put(params, "scopes", ["account:write", "forge:write"])

      end

    case ApiTokens.create(conn.assigns.current_user, params) do

      {:ok, token, plaintext} ->

        conn

defmodule OpenAgentsWeb.ChatResponseController do

  @moduledoc "Provides account-authenticated programmatic access to the chat runtime."

  use OpenAgentsWeb, :controller

  alias OpenAgents.Chat.Runner

  def create(conn, params) do

    with {:ok, request} <- Runner.request_from_params(params) do

      if params["stream"] == true do

        stream(conn, request)

      else

        complete(conn, request)

      end

    else

      {:error, :invalid_input} ->

        conn

        |> put_status(:unprocessable_entity)

        |> json(%{

          "error" => %{"code" => "invalid_input", "message" => "Provide valid input or messages."}

        })

    end

  end

  defp complete(conn, request) do

    {result, events} = collect(request, conn.assigns.current_user)

    case result do

      {:ok, completion} ->

        json(conn, response_body(completion, events))

      {:error, reason} ->

        provider_error(conn, reason)

    end

  end

  defp stream(conn, request) do

    conn =

      conn

      |> put_resp_header("content-type", "text/event-stream; charset=utf-8")

      |> put_resp_header("cache-control", "no-store")

      |> put_resp_header("x-accel-buffering", "no")

      |> send_chunked(200)

    owner = self()

    stream_id = make_ref()

    task =

      Task.Supervisor.async_nolink(OpenAgents.ProviderTaskSupervisor, fn ->

        Runner.stream(request, conn.assigns.current_user, fn event ->

          send(owner, {:account_chat_event, stream_id, event})

        end)

      end)

    stream_loop(conn, task, stream_id)

  end

  defp stream_loop(conn, task, stream_id) do

    receive do

      {:account_chat_event, ^stream_id, event} ->

        case chunk(conn, sse(event_payload(event))) do

          {:ok, conn} -> stream_loop(conn, task, stream_id)

          {:error, _closed} -> conn

        end

      {ref, {:ok, completion}} when ref == task.ref ->

        Process.demonitor(task.ref, [:flush])

        {:ok, conn} =

          chunk(

            conn,

            sse(%{"type" => "response.completed", "response" => response_body(completion, [])})

          )

        conn

      {ref, {:error, reason}} when ref == task.ref ->

        Process.demonitor(task.ref, [:flush])

        {:ok, conn} =

          chunk(conn, sse(%{"type" => "response.failed", "error" => error_body(reason)}))

        conn

      {:DOWN, ref, :process, _pid, reason} when ref == task.ref ->

        {:ok, conn} =

          chunk(conn, sse(%{"type" => "response.failed", "error" => error_body(reason)}))

        conn

    after

      130_000 ->

        Task.shutdown(task, :brutal_kill)

        {:ok, conn} =

          chunk(conn, sse(%{"type" => "response.failed", "error" => error_body(:timeout)}))

        conn

    end

  end

  defp collect(request, user) do

    key = {__MODULE__, make_ref()}

    Process.put(key, [])

    result =

      Runner.stream(request, user, fn event -> Process.put(key, [event | Process.get(key)]) end)

    events = key |> Process.get() |> Enum.reverse()

    Process.delete(key)

    {result, events}

  end

  defp response_body(completion, events) do

    %{

      "id" => completion["id"] || completion["assistant_message_id"],

      "object" => "response",

      "status" => "completed",

      "model" => completion["model"],

      "output_text" => completion["assistant_content"] || "",

      "reasoning" => completion["reasoning_summary"],

      "reasoning_items" => completion["reasoning_items"] || [],

      "tool_calls" => completion["tool_calls"] || [],

      "events" => Enum.map(events, &event_payload/1)

    }

  end

  defp event_payload({:text_delta, delta}),

    do: %{"type" => "response.output_text.delta", "delta" => delta}

  defp event_payload({:reasoning_delta, delta}),

    do: %{"type" => "response.reasoning.delta", "delta" => delta}

  defp event_payload({:tool_call_started, call}),

    do: %{"type" => "response.tool_call.started", "tool_call" => call}

  defp event_payload({:tool_call_completed, call}),

    do: %{"type" => "response.tool_call.completed", "tool_call" => call}

  defp event_payload({:tool_call_failed, call}),

    do: %{"type" => "response.tool_call.failed", "tool_call" => call}

  defp event_payload(event), do: %{"type" => "response.event", "data" => inspect(event)}

  defp sse(payload), do: "data: " <> Jason.encode!(payload) <> "\n\n"

  defp provider_error(conn, reason) do

    conn

    |> put_status(:bad_gateway)

    |> json(%{"error" => error_body(reason)})

  end

  defp error_body(reason),

    do: %{

      "code" => error_code(reason),

      "message" => "The chat provider could not complete the request."

    }

  defp error_code({:provider_error, code, _detail}), do: code

  defp error_code(reason) when is_atom(reason), do: Atom.to_string(reason)

  defp error_code(_reason), do: "provider_error"

end

        json(conn, %{

          "id" => user.github_id,

          "login" => user.github_login,

          "token_expires_at" => DateTime.to_iso8601(conn.assigns.api_token.expires_at),

          "token_expires_at" => serialized_expiration(conn.assigns.api_token.expires_at),

          "namespaces" =>

            Enum.map(namespaces, fn namespace ->

              %{

    end

  end

  defp serialized_expiration(nil), do: nil

  defp serialized_expiration(%DateTime{} = expires_at), do: DateTime.to_iso8601(expires_at)

  defp render_error(conn, :github_connection_required),

    do: error(conn, :forbidden, "github_connection_required", "Connect GitHub to continue")

  def handle_event("create", %{"api_token" => params}, socket) do

    case ApiTokens.create(socket.assigns.current_user, %{

           "name" => params["name"],

           "scopes" => ["forge:write"],

           "scopes" => ["account:write", "forge:write"],

           "lifetime_days" => params["lifetime_days"]

         }) do

      {:ok, token, plaintext} ->

         |> stream_insert(:tokens, token, at: 0)}

      {:error, _invalid} ->

        {:noreply, put_flash(socket, :error, "Choose a name and a lifetime from 1 to 90 days.")}

        {:noreply, put_flash(socket, :error, "Choose a name and a valid lifetime.")}

    end

  end

        <header class="space-y-2">

          <h1 class="text-3xl font-semibold tracking-tight">API tokens</h1>

          <p class="text-muted-foreground">

            Create an expiring credential for CLI forge writes. Tokens carry only <code>forge:write</code>, are stored as digests, and are shown once.

            Create a credential for API and CLI access to your account. Tokens are stored as digests and shown once. New tokens do not expire unless you choose a lifetime.

          </p>

        </header>

              <.input field={@form[:name]} placeholder="Release CLI" required />

            </.field>

            <.field>

              <.label for={@form[:lifetime_days].id}>Lifetime in days</.label>

              <.label for={@form[:lifetime_days].id}>Lifetime</.label>

              <.input

                field={@form[:lifetime_days]}

                type="number"

                min="1"

                max="90"

                required

                type="select"

                options={[

                  {"Does not expire", "never"},

                  {"7 days", "7"},

                  {"30 days", "30"},

                  {"90 days", "90"}

                ]}

              />

            </.field>

            <.button id="create-api-token" type="submit" variant={:primary}>

          <h2 id="api-token-list-heading" class="text-xl font-semibold">Credentials</h2>

          <div id="api-tokens" phx-update="stream" class="space-y-3">

            <.empty id="api-tokens-empty" title="No API tokens" class="hidden only:block">

              Create one when a CLI needs forge write access.

              Create one when an API client or CLI needs access to your account.

            </.empty>

            <.card :for={{id, token} <- @streams.tokens} id={id}>

              <div class="flex flex-wrap items-center justify-between gap-4">

                <div>

                  <strong>{token.name}</strong>

                  <p class="text-sm text-muted-foreground">

                    {Enum.join(token.scopes, ", ")} · expires {format_time(token.expires_at)}

                    {Enum.join(token.scopes, ", ")} · {expiration(token.expires_at)}

                  </p>

                  <.badge :if={token.revoked_at} variant={:danger}>REVOKED</.badge>

                </div>

  end

  defp token_form do

    to_form(%{"name" => "", "lifetime_days" => "30"}, as: :api_token)

    to_form(%{"name" => "", "lifetime_days" => "never"}, as: :api_token)

  end

  defp expiration(nil), do: "does not expire"

  defp expiration(%DateTime{} = value), do: "expires #{format_time(value)}"

  defp format_time(%DateTime{} = value),

    do: value |> DateTime.truncate(:second) |> DateTime.to_iso8601()

end

  use OpenAgentsWeb, :live_view

  alias OpenAgents.Chat.OpenRouter

  alias OpenAgents.Chat.{OpenRouter, Runner}

  @reasoning_options [

    {"Reasoning off", "none"},

    to_form(%{"message" => "", "reasoning" => reasoning}, as: :chat)

  end

  defp local_chat_request(messages, message, reasoning) do

    %{

      "model" => OpenRouter.default_model(),

      "models" => ["openrouter/free"],

      "reasoning" => reasoning,

      "messages" =>

        Enum.map(messages, &provider_message/1) ++ [%{"role" => "user", "content" => message}]

    }

  end

  defp submit_message(socket, message, reasoning) do

    stream_id = System.unique_integer([:positive, :monotonic])

    owner = self()

    request =

      local_chat_request(

      Runner.request(

        Enum.filter(socket.assigns.messages, fn message -> message.history? end),

        message,

        reasoning

    task =

      Task.Supervisor.async_nolink(OpenAgents.ProviderTaskSupervisor, fn ->

        OpenRouter.stream(

        Runner.stream(

          request,

          socket.assigns.current_user,

          fn event -> send(owner, {:openrouter_stream_event, stream_id, event}) end,

          tool_context: %{user: socket.assigns.current_user}

          []

        )

      end)

    update(socket, :messages, &(&1 ++ [assistant]))

  end

  defp provider_message(%{role: :assistant} = message) do

    %{"role" => "assistant", "content" => message.content}

    |> maybe_put_provider_message_id(message.provider_message_id)

    |> maybe_put_provider_status(message.provider_status)

    |> maybe_put_provider_reasoning_items(message.provider_reasoning_items)

  end

  defp provider_message(%{role: role, content: content}),

    do: %{"role" => Atom.to_string(role), "content" => content}

  defp maybe_put_provider_message_id(message, id) when is_binary(id),

    do: Map.put(message, "id", id)

  defp maybe_put_provider_message_id(message, _id), do: message

  defp maybe_put_provider_status(message, status) when is_binary(status),

    do: Map.put(message, "status", status)

  defp maybe_put_provider_status(message, _status), do: message

  defp maybe_put_provider_reasoning_items(message, items) when is_list(items) and items != [],

    do: Map.put(message, "reasoning_items", items)

  defp maybe_put_provider_reasoning_items(message, _items), do: message

  defp error_message(:missing_api_key), do: "OpenRouter is not configured for this environment."

  defp error_message(:rate_limited), do: "OpenRouter is rate-limited. Try again later."

  defp policy(%{path: "/api/inference/proxy"}),

    do: declaration(:internal_service, "scoped inference grant", "inference:invoke", true)

  defp policy(%{path: "/api/v1/chat/responses", verb: :post}),

    do: declaration(:authenticated_api, "first-party account bearer token", "account:write", true)

  defp policy(%{path: "/api/v3/device/authorizations" <> _path, verb: :post}),

    do:

      declaration(

    plug OpenAgentsWeb.Plugs.ApiTokenAuth, scope: "forge:write"

  end

  pipeline :account_api do

    plug :accepts, ["json"]

    plug OpenAgentsWeb.Plugs.RequestOrigin

    plug OpenAgentsWeb.Plugs.ApiTokenAuth, scope: "account:write"

  end

  pipeline :optional_forge_api do

    plug :accepts, ["json"]

    plug OpenAgentsWeb.Plugs.RequestOrigin

    delete "/computer-agent-jobs/:id", ComputerAgentJobsController, :delete

  end

  scope "/api/v1", OpenAgentsWeb do

    pipe_through :account_api

    post "/chat/responses", ChatResponseController, :create

  end

  scope "/admin", OpenAgentsWeb do

    pipe_through [:browser, :authenticated, :operator]

Create a token and copy it immediately. Only a hash is stored, so the value

cannot be shown again — if you lose it, revoke it and create another.

Manual tokens do not expire by default. You can choose a 7-, 30-, or 90-day

lifetime. A manual token carries `account:write` for account APIs and

`forge:write` for repository APIs.

## Using a token

Send it as a bearer token:

## Understand the scope

A token acts as you. It reaches what your account reaches and nothing more.

The server derives your identity from the token and ignores caller-supplied

identity claims.

## Call chat programmatically

`POST /api/v1/chat/responses` uses the same model, repository tools, reasoning

events, and tool-result events as `/chat`.

```

curl https://openagents.com/api/v1/chat/responses \

  -H "Authorization: Bearer $OPENAGENTS_TOKEN" \

  -H "Content-Type: application/json" \

  -d '{"input":"Read the README of my connected repository."}'

```

Add `"stream":true` to receive server-sent events.

GET    /api/v3/repository-imports/:id

```

## Chat responses

```text

POST /api/v1/chat/responses

```

This endpoint requires an `oa_pat_` token with `account:write`. Send `input` as

a string, or send `messages` as a list of `system`, `user`, and `assistant`

messages. Set `stream` to `true` for server-sent reasoning, tool-call,

tool-result, text, and completion events. The endpoint uses the same server

model and account-scoped repository tools as `/chat`.

Repository writes require an `Idempotency-Key` header. The published

[`openagents.repositories.v1` contract](/api/contracts/repositories-v1.json)

defines request authority, lifecycle states, pagination, and stable error

    20260822082657,

    20260822120326,

    20260822132511,

    20260822153929

    20260822153929,

    20260822223012

  ],

  "required_tables": [

    "users",

defmodule OpenAgents.Repo.Migrations.AllowNonExpiringAccountApiTokens do

  use Ecto.Migration

  def up do

    drop constraint(:api_tokens, :api_tokens_expiry_after_creation)

    drop constraint(:api_tokens, :api_tokens_scopes_allowed)

    alter table(:api_tokens) do

      modify :expires_at, :utc_datetime_usec, null: true

    end

    create constraint(:api_tokens, :api_tokens_scopes_allowed,

             check: "scopes <@ ARRAY['account:write', 'forge:write']::varchar[]"

           )

    create constraint(:api_tokens, :api_tokens_expiry_after_creation,

             check: "expires_at IS NULL OR expires_at > inserted_at"

           )

  end

  def down do

    drop constraint(:api_tokens, :api_tokens_expiry_after_creation)

    drop constraint(:api_tokens, :api_tokens_scopes_allowed)

    execute("DELETE FROM api_tokens WHERE expires_at IS NULL OR 'account:write' = ANY(scopes)")

    alter table(:api_tokens) do

      modify :expires_at, :utc_datetime_usec, null: false

    end

    create constraint(:api_tokens, :api_tokens_scopes_allowed,

             check: "scopes <@ ARRAY['forge:write']::varchar[]"

           )

    create constraint(:api_tokens, :api_tokens_expiry_after_creation,

             check: "expires_at > inserted_at"

           )

  end

end

             })

  end

  test "account tokens do not expire by default and remain account-scoped" do

    {:ok, user} = Accounts.upsert_github_user(profile(803, "api-account"))

    assert {:ok, token, plaintext} =

             ApiTokens.create(user, %{

               name: "account automation",

               scopes: ["account:write", "forge:write"]

             })

    assert is_nil(token.expires_at)

    assert {:ok, ^user, _used} = ApiTokens.authenticate(plaintext, "account:write")

    assert {:ok, ^user, _used} = ApiTokens.authenticate(plaintext, "forge:write")

    assert {:error, :invalid_api_token} = ApiTokens.authenticate(plaintext, "admin")

  end

  defp profile(id, login) do

    %{

      github_id: id,

    assert {:error, :invalid_api_token} = ApiTokens.authenticate(plaintext, "forge:write")

  end

  test "browser issuance defaults to a non-expiring account credential", %{conn: conn} do

    user = github_user("default-account-token-owner")

    browser = Plug.Test.init_test_session(conn, %{"user_id" => user.id})

    issued = post(browser, ~p"/api/tokens", %{name: "programmatic client"})

    assert %{

             "token" => plaintext,

             "credential" => %{

               "expires_at" => nil,

               "scopes" => ["account:write", "forge:write"]

             }

           } = json_response(issued, 201)

    assert {:ok, ^user, _token} = ApiTokens.authenticate(plaintext, "account:write")

  end

  test "forge mutations refuse missing, malformed, expired, and revoked credentials", %{

    conn: conn

  } do

defmodule OpenAgentsWeb.ChatResponseControllerTest do

  use OpenAgentsWeb.ConnCase, async: false

  setup do

    previous = Application.get_env(:openagents, :chat_provider)

    Application.put_env(:openagents, :chat_provider, OpenAgents.ChatProviderStub)

    on_exit(fn ->

      if previous do

        Application.put_env(:openagents, :chat_provider, previous)

      else

        Application.delete_env(:openagents, :chat_provider)

      end

    end)

  end

  test "an account token runs chat with the issuing user's authority", %{conn: conn} do

    user = github_user("account-chat-owner")

    conn = put_account_api_token_for_user(conn, user)

    response = post(conn, ~p"/api/v1/chat/responses", %{input: "Read my repository."})

    assert %{

             "status" => "completed",

             "model" => "test/provider",

             "output_text" => output,

             "events" => events

           } = json_response(response, 200)

    assert output == "#{user.github_login}: Read my repository."

    assert Enum.map(events, & &1["type"]) == [

             "response.reasoning.delta",

             "response.tool_call.started",

             "response.tool_call.completed",

             "response.output_text.delta"

           ]

  end

  test "the streaming response exposes reasoning, tools, text, and completion", %{conn: conn} do

    user = github_user("account-chat-stream-owner")

    response =

      conn

      |> put_account_api_token_for_user(user)

      |> post(~p"/api/v1/chat/responses", %{input: "Stream this.", stream: true})

    body = response.resp_body

    assert body =~ "response.reasoning.delta"

    assert body =~ "response.tool_call.started"

    assert body =~ "response.tool_call.completed"

    assert body =~ "response.output_text.delta"

    assert body =~ "response.completed"

  end

  test "missing and forge-only tokens cannot control an account", %{conn: conn} do

    path = ~p"/api/v1/chat/responses"

    assert conn |> post(path, %{input: "Denied"}) |> json_response(401)

    user = github_user("forge-only-chat-owner")

    {:ok, _credential, plaintext} =

      OpenAgents.ApiTokens.create(user, %{

        name: "forge only",

        scopes: ["forge:write"],

        lifetime_days: 1

      })

    denied =

      conn

      |> put_req_header("authorization", "Bearer " <> plaintext)

      |> post(path, %{input: "Denied"})

    assert json_response(denied, 401) == %{"error" => "invalid_api_token"}

  end

  test "revocation immediately removes account authority", %{conn: conn} do

    user = github_user("revoked-account-chat-owner")

    {:ok, credential, plaintext} =

      OpenAgents.ApiTokens.create(user, %{

        name: "revoked account client",

        scopes: ["account:write", "forge:write"]

      })

    assert {:ok, _credential} = OpenAgents.ApiTokens.revoke(user, credential.id)

    denied =

      conn

      |> put_req_header("authorization", "Bearer " <> plaintext)

      |> post(~p"/api/v1/chat/responses", %{input: "Denied"})

    assert json_response(denied, 401) == %{"error" => "invalid_api_token"}

  end

end

             "namespaces" => [

               %{"id" => namespace_id, "login" => "octavia", "type" => "user"}

             ],

             "token_expires_at" => token_expires_at

             "token_expires_at" => nil

           } = json_response(response, 200)

    assert github_id == user.github_id

    assert namespace_id == user.github_id

    assert {:ok, _date_time, 0} = DateTime.from_iso8601(token_expires_at)

    assert get_resp_header(response, "cache-control") == ["no-store"]

  end

defmodule OpenAgents.ChatProviderStub do

  @moduledoc false

  def stream(request, on_event, options) do

    user = options |> Keyword.fetch!(:tool_context) |> Map.fetch!(:user)

    message = request["messages"] |> List.last() |> Map.fetch!("content")

    on_event.({:reasoning_delta, "Checking account context."})

    on_event.(

      {:tool_call_started, %{"id" => "call_1", "name" => "test_account", "arguments" => %{}}}

    )

    on_event.(

      {:tool_call_completed,

       %{"id" => "call_1", "name" => "test_account", "result" => %{"login" => user.github_login}}}

    )

    output = "#{user.github_login}: #{message}"

    on_event.({:text_delta, output})

    {:ok,

     %{

       "object" => "response",

       "model" => "test/provider",

       "assistant_message_id" => "msg_test",

       "assistant_content" => output,

       "reasoning_summary" => "Checking account context."

     }}

  end

end

    Plug.Conn.put_req_header(conn, "authorization", "Bearer " <> plaintext)

  end

  def put_account_api_token_for_user(conn, user) do

    {:ok, _credential, plaintext} =

      OpenAgents.ApiTokens.create(user, %{

        name: "test account client",

        scopes: ["account:write", "forge:write"]

      })

    Plug.Conn.put_req_header(conn, "authorization", "Bearer " <> plaintext)

  end

  @doc """

  Logs in an account and grants it operator access for the duration of the test.

  """