// Cloud session + membership helpers shared by the scenarios that need MORE// than one identity in an org.//// Every one of these is a thin wrapper over a REAL product endpoint — there is// no back door here. They were copy-pasted verbatim into four cloud scenarios// before living here, and the copies drifted in the two ways that matter, both// now folded in:////   - only one carried `forBrowser`, the fix for the fact that `joinOrg`//     refreshes `headers.cookie` (the sealed session is re-issued on the new//     org) but leaves `cookies` on the PRE-join value — and the browser context//     is seeded from `cookies`. A scenario on a stale copy browses as the//     person's old org while its API calls use the new one.//   - only one forwarded the ORG SELECTOR header. Org-scoped endpoints fail//     closed without it (`AccountNoOrganization`), so a cookie-only copy cannot//     even build the fixture: `/api/account/members/invite` 403s.//// `cloud/*.test.ts` is a vitest `include` of `*.test.ts` only, so this module// is never collected as a suite.import { Effect } from "effect"; import type { Identity, Target as TargetShape } from "../../src/target"; /** * The per-request org selector. `/api/auth/switch-organization` was removed * (#1000): the URL prefix or this header is the scope authority now, and the * session's own org is only a default. * * This is the RIGHT way to read one account's data in a specific org: a session * cookie captured before the account joined another org is stale the moment the * later `accept-invitation` re-seals it, so holding onto the old cookie reads as * an unauthenticated caller. Take the CURRENT identity and point it at the org * you mean. * * Mirrors `ORG_SELECTOR_HEADER` in `apps/cloud/src/auth/organization.ts` * (`EXECUTOR_ORG_SELECTOR_HEADER` in the SDK's shared exports); duplicated as a * literal so the e2e suite stays a black-box client of the deployed product. */const ORG_SELECTOR_HEADER = "x-executor-organization"; /** The session cookie header this identity authenticates API calls with. */export const cookieOf = (identity: Identity): string => identity.headers?.["cookie"] ?? ""; /** * The identity re-bound so the BROWSER carries the same session the API calls * do. `joinOrg` / `createOrg` refresh `headers.cookie` (the org is baked into * the sealed session) but leave `cookies` on the pre-change value, and the * browser context is seeded from `cookies`. */export const forBrowser = (identity: Identity): Identity => {  const cookie = cookieOf(identity);  const separator = cookie.indexOf("=");  if (separator < 0) throw new Error("identity carries no session cookie");  return {    ...identity,    cookies: [{ name: cookie.slice(0, separator), value: cookie.slice(separator + 1) }],  };}; /** POST as `identity`, failing loudly on a non-2xx (a silent skip here would *  leave the scenario asserting against a half-built fixture). * *  Sends the identity's OWN headers, not just its cookie: org-scoped endpoints *  (`/api/account/members/invite` among them) fail closed with *  `AccountNoOrganization` when the org selector header is absent, because the *  session's own org is only a default and is never fallen back to. */export const postJson = (  target: TargetShape,  path: string,  identity: Identity,  body: unknown,): Effect.Effect<Response> =>  Effect.promise(async () => {    const response = await fetch(new URL(path, target.baseUrl), {      method: "POST",      headers: {        ...(identity.headers ?? {}),        "content-type": "application/json",        origin: new URL(target.baseUrl).origin,      },      body: JSON.stringify(body),    });    if (!response.ok) {      throw new Error(`${path} failed (${response.status}): ${await response.text()}`);    }    return response;  }); /** The identity re-bound to the refreshed session cookie a response set, and *  scoped to `orgSelector` — carrying the cookie alone would leave every *  org-scoped read the identity goes on to make failing closed. */export const withRefreshedSession = (  identity: Identity,  response: Response,  orgSelector: string,): Identity => {  const refreshed = (response.headers.getSetCookie?.() ?? [])    .find((header) => header.startsWith("wos-session="))    ?.split(";")[0];  if (!refreshed) throw new Error("response did not refresh the session cookie");  return { ...identity, headers: { cookie: refreshed, [ORG_SELECTOR_HEADER]: orgSelector } };}; /** The org selector this identity's requests carry — the same header the web *  client derives from the console URL's slug. */export const orgSelectorOf = (identity: Identity): string => {  const selector = identity.headers?.[ORG_SELECTOR_HEADER];  if (!selector) throw new Error(`identity ${identity.label} carries no org selector header`);  return selector;}; /** * Invite `member` into `admin`'s org and accept — the real invite flow. The * invite carries no roleSlug, so the joiner lands as a plain MEMBER (the actor * an access-denial assertion needs); pass `roleSlug` for anything else. * * The returned identity is bound to the newly-joined org — the re-sealed * session from accept-invitation, scoped by the selector to the org they were * invited INTO (`admin`'s). Calling this twice for one person is how a scenario * builds a multi-org member: the WorkOS membership in the earlier org persists, * and both the session and the selector point at the later one. */export const joinOrg = (  target: TargetShape,  admin: Identity,  member: Identity,  options: { readonly roleSlug?: string } = {},): Effect.Effect<Identity> =>  Effect.gen(function* () {    const inviteResponse = yield* postJson(target, "/api/account/members/invite", admin, {      email: member.credentials?.email,      ...(options.roleSlug === undefined ? {} : { roleSlug: options.roleSlug }),    });    const invitation = (yield* Effect.promise(() => inviteResponse.json())) as { id: string };    const acceptResponse = yield* postJson(target, "/api/auth/accept-invitation", member, {      invitationId: invitation.id,    });    return withRefreshedSession(member, acceptResponse, orgSelectorOf(admin));  }); /** Create another org for this account; returns the identity bound to it. */export const createOrg = (  target: TargetShape,  identity: Identity,  name: string,): Effect.Effect<Identity> =>  Effect.gen(function* () {    const response = yield* postJson(target, "/api/auth/create-organization", identity, { name });    const created = (yield* Effect.promise(() => response.clone().json())) as { id: string };    return withRefreshedSession(identity, response, created.id);  }); /** This identity, scoped to `organizationId` for the requests it makes. */export const inOrg = (identity: Identity, organizationId: string): Identity => ({  ...identity,  headers: { ...identity.headers, [ORG_SELECTOR_HEADER]: organizationId },}); /** The caller's own account id — the `externalId` the admin plane reports and *  the users page renders in mono. */export const accountIdOf = (target: TargetShape, identity: Identity): Effect.Effect<string> =>  Effect.promise(async () => {    const response = await fetch(new URL("/api/account/me", target.baseUrl), {      headers: { cookie: cookieOf(identity) },    });    if (!response.ok) throw new Error(`/api/account/me failed (${response.status})`);    const body = (await response.json()) as { user: { id: string } };    return body.user.id;  }); /** The org this identity's session is currently bound to: id and URL slug. */export const activeOrg = (  target: TargetShape,  identity: Identity,): Effect.Effect<{ readonly id: string; readonly slug: string }> =>  Effect.promise(async () => {    const response = await fetch(new URL("/api/auth/me", target.baseUrl), {      headers: { cookie: cookieOf(identity) },    });    if (!response.ok) throw new Error(`/api/auth/me failed (${response.status})`);    const body = (await response.json()) as {      organization: { id: string; slug: string } | null;    };    if (!body.organization) throw new Error("identity has no active organization");    return { id: body.organization.id, slug: body.organization.slug };  }); /** Every org this account is a member of, plus the one the session is on. */export const organizationsOf = (  target: TargetShape,  identity: Identity,): Effect.Effect<{  readonly organizations: ReadonlyArray<{ readonly id: string; readonly slug: string }>;  readonly activeOrganizationId: string | null;}> =>  Effect.promise(async () => {    const response = await fetch(new URL("/api/auth/organizations", target.baseUrl), {      headers: { cookie: cookieOf(identity) },    });    if (!response.ok) throw new Error(`/api/auth/organizations failed (${response.status})`);    return (await response.json()) as {      organizations: ReadonlyArray<{ id: string; slug: string }>;      activeOrganizationId: string | null;    };  });