From 4d66314ee2523588309454fb4e5ff50b2c135c61 Mon Sep 17 00:00:00 2001 From: Kai Koenig Date: Tue, 23 Jun 2026 23:16:57 +1200 Subject: [PATCH 1/2] docs: add custom auth review guidance --- skills/reviewing-integration-prs/SKILL.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/skills/reviewing-integration-prs/SKILL.md b/skills/reviewing-integration-prs/SKILL.md index f1af3f5..e1d0d0d 100644 --- a/skills/reviewing-integration-prs/SKILL.md +++ b/skills/reviewing-integration-prs/SKILL.md @@ -103,6 +103,18 @@ Check for: For migrations to public, apply the `migrating-private-integration` security/safety/secrets checklist. Security review should be explicit in the PR body. +### 4.1 Custom auth contract review + +For integrations using `auth.type == "custom"`, verify the config, code, and tests match the Autohive runtime contract: + +- `auth.fields.required` is absent or empty. Non-empty custom-auth `required` arrays are blockers because credential presence is handled by the platform connection flow, not integration JSON Schema validation. +- `auth.fields.properties` declares every credential field that action code reads from `context.auth`. +- Action code does not read undeclared credential keys from `context.auth`. +- At least one unit test exercises `integration.execute_action(...)` with the expected SDK/platform auth shape, rather than only testing helper functions or using a convenient mock shape. +- Live integration tests, if present, are not treated as CI coverage unless the CI logs explicitly show they were run. + +Ask explicitly during review: **Does this PR test the same SDK/platform contract that production will use?** + ### 5. Tests and `.env.example` The root `.env.example` check is mandatory for any PR that adds or changes `test_*_integration.py`. Do not rely on CI to catch this; review it manually against the test file. From 9f7e817625da7676f52cd41d6c4a6396644c85d1 Mon Sep 17 00:00:00 2001 From: Kai Koenig Date: Wed, 24 Jun 2026 00:45:02 +1200 Subject: [PATCH 2/2] docs: clarify custom auth required review --- skills/reviewing-integration-prs/SKILL.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/skills/reviewing-integration-prs/SKILL.md b/skills/reviewing-integration-prs/SKILL.md index e1d0d0d..af3f70a 100644 --- a/skills/reviewing-integration-prs/SKILL.md +++ b/skills/reviewing-integration-prs/SKILL.md @@ -107,10 +107,12 @@ For migrations to public, apply the `migrating-private-integration` security/saf For integrations using `auth.type == "custom"`, verify the config, code, and tests match the Autohive runtime contract: -- `auth.fields.required` is absent or empty. Non-empty custom-auth `required` arrays are blockers because credential presence is handled by the platform connection flow, not integration JSON Schema validation. -- `auth.fields.properties` declares every credential field that action code reads from `context.auth`. +- `auth.fields` describes the same auth object shape the SDK/platform passes to `context.auth` at execution time. Do not assume flat or wrapped credentials without checking the current SDK/platform contract. +- If `auth.fields.required` is present, it matches that runtime auth shape and covers credentials that must be present before handlers run. Non-empty `required` arrays are valid when they match the SDK/platform contract. +- `auth.fields.properties` declares every credential field that action code reads from `context.auth`, including nested credential fields if the runtime contract is wrapped. - Action code does not read undeclared credential keys from `context.auth`. - At least one unit test exercises `integration.execute_action(...)` with the expected SDK/platform auth shape, rather than only testing helper functions or using a convenient mock shape. +- Tests cover missing required credentials when the config uses `auth.fields.required`, so credential validation is not accidentally bypassed. - Live integration tests, if present, are not treated as CI coverage unless the CI logs explicitly show they were run. Ask explicitly during review: **Does this PR test the same SDK/platform contract that production will use?**