import { describe, expect, it } from "@effect/vitest";import { Effect, Exit, Layer } from "effect"; import {  ApiKeyService,  ApiKeyValidationError,  makeCachedApiKeyValidate,  type ApiKeyOwner,} from "./api-keys";import { WorkOSClient, type WorkOSClientService } from "./workos"; const stubWorkOS = (overrides: Partial<WorkOSClientService>) =>  Layer.succeed(    WorkOSClient,    new Proxy({} as WorkOSClientService, {      get: (_target, prop) => {        if (prop in overrides) return overrides[prop as keyof WorkOSClientService];        return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);      },    }),  ); const userOwner = (keyId: string): ApiKeyOwner => ({  scope: "user",  accountId: "user_123",  organizationId: "org_123",  keyId,}); describe("makeCachedApiKeyValidate", () => {  it.effect("serves a repeat validation from cache without a second upstream call", () =>    Effect.gen(function* () {      let calls = 0;      const cached = makeCachedApiKeyValidate(() =>        Effect.sync(() => {          calls += 1;          return userOwner("api_key_1");        }),      );       const first = yield* cached.validate("sk_test_abc");      const second = yield* cached.validate("sk_test_abc");       expect(calls).toBe(1);      expect(first).toEqual(userOwner("api_key_1"));      expect(second).toEqual(first);    }),  );   it.effect("re-validates once the TTL has expired", () =>    Effect.gen(function* () {      let calls = 0;      let nowMs = 0;      const cached = makeCachedApiKeyValidate(        () =>          Effect.sync(() => {            calls += 1;            return userOwner("api_key_1");          }),        { ttlMs: 1_000, now: () => nowMs },      );       yield* cached.validate("sk_test_abc");      nowMs = 999;      yield* cached.validate("sk_test_abc");      expect(calls).toBe(1);       nowMs = 1_000;      yield* cached.validate("sk_test_abc");      expect(calls).toBe(2);    }),  );   it.effect("never caches an invalid key", () =>    Effect.gen(function* () {      let calls = 0;      const cached = makeCachedApiKeyValidate(() =>        Effect.sync(() => {          calls += 1;          return null;        }),      );       const first = yield* cached.validate("sk_test_bad");      const second = yield* cached.validate("sk_test_bad");       expect(first).toBeNull();      expect(second).toBeNull();      expect(calls).toBe(2);      expect(cached.cacheKeys()).toHaveLength(0);    }),  );   it.effect("never caches an upstream failure", () =>    Effect.gen(function* () {      let calls = 0;      const cached = makeCachedApiKeyValidate(() =>        Effect.suspend(() => {          calls += 1;          return Effect.fail(new ApiKeyValidationError({ cause: "workos_down" }));        }),      );       const first = yield* Effect.exit(cached.validate("sk_test_abc"));      const second = yield* Effect.exit(cached.validate("sk_test_abc"));       expect(Exit.isFailure(first)).toBe(true);      expect(Exit.isFailure(second)).toBe(true);      expect(calls).toBe(2);      expect(cached.cacheKeys()).toHaveLength(0);    }),  );   it.effect("resets a saturated map of live entries rather than growing past the bound", () =>    Effect.gen(function* () {      const cached = makeCachedApiKeyValidate((value) => Effect.succeed(userOwner(value)), {        maxEntries: 3,      });       for (const value of ["sk_1", "sk_2", "sk_3"]) {        yield* cached.validate(value);      }      expect(cached.cacheKeys()).toHaveLength(3);       // Nothing is expired, so a fourth live entry resets the map instead of      // growing it (mirrors execution-gate's writeCache).      yield* cached.validate("sk_4");      expect(cached.cacheKeys()).toHaveLength(1);       yield* cached.validate("sk_5");      expect(cached.cacheKeys()).toHaveLength(2);    }),  );   it.effect("evicts expired entries before resetting a saturated map", () =>    Effect.gen(function* () {      let nowMs = 0;      const cached = makeCachedApiKeyValidate((value) => Effect.succeed(userOwner(value)), {        ttlMs: 1_000,        maxEntries: 3,        now: () => nowMs,      });       for (const value of ["sk_1", "sk_2", "sk_3"]) {        yield* cached.validate(value);      }      expect(cached.cacheKeys()).toHaveLength(3);       // Everything is expired: the sweep drops the stale entries and the new      // one fits without a full reset.      nowMs = 2_000;      yield* cached.validate("sk_4");      expect(cached.cacheKeys()).toHaveLength(1);    }),  );   it.effect("keys the cache by the SHA-256 digest, never the raw key value", () =>    Effect.gen(function* () {      const rawKey = "sk_live_super_secret_value";      const cached = makeCachedApiKeyValidate(() => Effect.succeed(userOwner("api_key_1")));       yield* cached.validate(rawKey);       const expectedDigest = yield* Effect.promise(async () => {        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(rawKey));        return Array.from(new Uint8Array(digest), (byte) =>          byte.toString(16).padStart(2, "0"),        ).join("");      });      expect(cached.cacheKeys()).toEqual([expectedDigest]);      expect(cached.cacheKeys()).not.toContain(rawKey);    }),  );}); describe("ApiKeyService.WorkOS validation cache", () => {  it.effect("validates a repeated key through one upstream call per layer build", () =>    Effect.gen(function* () {      let calls = 0;      const layer = ApiKeyService.WorkOS.pipe(        Layer.provide(          stubWorkOS({            validateApiKey: () =>              Effect.sync(() => {                calls += 1;                return {                  apiKey: {                    id: "api_key_123",                    owner: { type: "user", id: "user_123", organizationId: "org_123" },                  },                };              }),          }),        ),      );       const { first, second } = yield* Effect.gen(function* () {        const apiKeys = yield* ApiKeyService;        return {          first: yield* apiKeys.validate("sk_test_abc"),          second: yield* apiKeys.validate("sk_test_abc"),        };      }).pipe(Effect.provide(layer));       expect(calls).toBe(1);      expect(first?.keyId).toBe("api_key_123");      expect(second).toEqual(first);    }),  );});