import { describe, expect, it } from "@effect/vitest";import { Effect, Layer, ManagedRuntime } from "effect"; import { ApiKeyService } from "../auth/api-keys";import { WorkOSClient, type WorkOSClientService } from "../auth/workos";import {  makeBindingKeyedRuntime,  mcpAuthBindingsFingerprint,  type McpAuthBindings,} from "./auth-runtime"; const stubWorkOS = (overrides: Partial<WorkOSClientService>) =>  Layer.succeed(    WorkOSClient,    new Proxy({} as WorkOSClientService, {      get: (_target, prop) => {        if (prop in overrides) return overrides[prop as keyof WorkOSClientService];        return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);      },    }),  ); // The same shape the memoized MCP auth runtime holds in production: the real// `ApiKeyService.WorkOS` layer (validation cache included) over a counting// upstream, one fresh build per `build()` call.const makeCountingAuthRuntime = () => {  const counters = { upstreamCalls: 0, builds: 0 };  const layer = ApiKeyService.WorkOS.pipe(    Layer.provide(      stubWorkOS({        validateApiKey: () =>          Effect.sync(() => {            counters.upstreamCalls += 1;            return {              apiKey: {                id: "api_key_123",                owner: { type: "user", id: "user_123", organizationId: "org_123" },              },            };          }),      }),    ),  );  const runtimeFor = makeBindingKeyedRuntime(() => {    counters.builds += 1;    return ManagedRuntime.make(layer);  });  // One "request": resolve ApiKeyService from the memoized runtime the  // fingerprint selects and validate the same key, as `runTraced` would.  const request = (fingerprint: string) =>    Effect.promise(() =>      runtimeFor(fingerprint).runPromise(        Effect.flatMap(ApiKeyService.asEffect(), (apiKeys) => apiKeys.validate("sk_test_abc")),      ),    );  return { counters, runtimeFor, request };}; const bindings = (overrides?: Partial<McpAuthBindings>): McpAuthBindings => ({  WORKOS_API_KEY: "sk_workos_1",  WORKOS_CLIENT_ID: "client_1",  WORKOS_COOKIE_PASSWORD: "cookie_password_at_least_32_chars!!",  ...overrides,}); describe("makeBindingKeyedRuntime", () => {  it.effect("reuses the runtime — and its validation cache — while bindings are unchanged", () =>    Effect.gen(function* () {      const { counters, runtimeFor, request } = makeCountingAuthRuntime();       const first = yield* request("fingerprint_a");      const second = yield* request("fingerprint_a");       expect(counters.builds).toBe(1);      // The second request hit the cached validation, not the upstream.      expect(counters.upstreamCalls).toBe(1);      expect(first?.keyId).toBe("api_key_123");      expect(second).toEqual(first);      expect(runtimeFor("fingerprint_a")).toBe(runtimeFor("fingerprint_a"));    }),  );   it.effect("rebuilds a fresh runtime — resetting the validation cache — on a binding change", () =>    Effect.gen(function* () {      const { counters, runtimeFor, request } = makeCountingAuthRuntime();       const before = runtimeFor("fingerprint_a");      yield* request("fingerprint_a");      expect(counters.upstreamCalls).toBe(1);       // Rotated bindings: a fresh runtime (fresh ApiKeyService, empty cache),      // so the same key must be re-validated upstream.      yield* request("fingerprint_b");      expect(counters.builds).toBe(2);      expect(counters.upstreamCalls).toBe(2);      expect(runtimeFor("fingerprint_b")).not.toBe(before);    }),  );   it.effect("holds only the latest runtime, so flapping back also rebuilds", () =>    Effect.gen(function* () {      const { counters, request } = makeCountingAuthRuntime();       yield* request("fingerprint_a");      yield* request("fingerprint_b");      yield* request("fingerprint_a");       expect(counters.builds).toBe(3);      expect(counters.upstreamCalls).toBe(3);    }),  );}); describe("mcpAuthBindingsFingerprint", () => {  it("is stable for identical bindings", () => {    expect(mcpAuthBindingsFingerprint(bindings())).toBe(mcpAuthBindingsFingerprint(bindings()));  });   it("changes when any captured binding changes", () => {    const base = mcpAuthBindingsFingerprint(bindings());    expect(mcpAuthBindingsFingerprint(bindings({ WORKOS_API_KEY: "sk_workos_2" }))).not.toBe(base);    expect(mcpAuthBindingsFingerprint(bindings({ WORKOS_CLIENT_ID: "client_2" }))).not.toBe(base);    expect(      mcpAuthBindingsFingerprint(        bindings({ WORKOS_COOKIE_PASSWORD: "another_cookie_password_32_chars!!!" }),      ),    ).not.toBe(base);    expect(      mcpAuthBindingsFingerprint(bindings({ WORKOS_API_URL: "http://127.0.0.1:8788" })),    ).not.toBe(base);  });   it("treats an unset WORKOS_API_URL the same as the client does (no override)", () => {    // `workosApiUrlOptions` resolves both to "no override", so they may share    // a fingerprint — a rebuild between them would change nothing.    expect(mcpAuthBindingsFingerprint(bindings({ WORKOS_API_URL: "" }))).toBe(      mcpAuthBindingsFingerprint(bindings()),    );  });   it("never collides when a delimiter-like byte sits inside a value", () => {    // Bindings may contain any byte (workerd Text permits embedded NUL). A    // raw joined fingerprint would let a NUL inside one value shift the field    // boundary so two DIFFERENT binding sets collide — suppressing the    // rebuild a rotation requires. JSON encoding escapes every byte, so these    // two sets, which collide under a NUL join, must fingerprint differently.    const a = mcpAuthBindingsFingerprint(      bindings({        WORKOS_COOKIE_PASSWORD: "cookie\u0000https://old.example/path",        WORKOS_API_URL: "https://new.example",      }),    );    const b = mcpAuthBindingsFingerprint(      bindings({        WORKOS_COOKIE_PASSWORD: "cookie",        WORKOS_API_URL: "https://old.example/path\u0000https://new.example",      }),    );    expect(a).not.toBe(b);  });});