import { mkdtempSync } from "node:fs";import { tmpdir } from "node:os";import { join } from "node:path"; import { afterAll, expect, test } from "@effect/vitest"; import { mintInviteCode } from "../testing/mint-invite"; process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-env-"));process.env.BETTER_AUTH_SECRET = "env-test-secret-0123456789-abcdefghij-klmnop";process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@env.test";process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-pass-123456"; const { makeSelfHostApiHandler } = await import("../app");const { handler, dispose } = await makeSelfHostApiHandler();afterAll(() => dispose()); const BASE = "http://localhost:4788"; test("serves OAuth Authorization Server metadata at the origin root", async () => {  const res = await handler(new Request(`${BASE}/.well-known/oauth-authorization-server`));  expect(res.status).toBe(200);  const body = (await res.json()) as Record<string, unknown>;  expect(body.issuer).toBeDefined();  // mcp() advertises its DCR + authorize + token endpoints under /api/auth/mcp.  expect(String(body.authorization_endpoint)).toContain("/api/auth/mcp/authorize");  expect(String(body.token_endpoint)).toContain("/api/auth/mcp/token");  expect(String(body.registration_endpoint)).toContain("/api/auth/mcp/register");}); test("serves OAuth Protected Resource metadata at the origin root", async () => {  const res = await handler(new Request(`${BASE}/.well-known/oauth-protected-resource`));  expect(res.status).toBe(200);  const body = (await res.json()) as Record<string, unknown>;  expect(body.resource).toBeDefined();  expect(Array.isArray(body.authorization_servers)).toBe(true);}); test("serves OAuth Protected Resource metadata for a toolkit MCP resource", async () => {  const res = await handler(    new Request(`${BASE}/.well-known/oauth-protected-resource/mcp/toolkits/deploy`),  );  expect(res.status).toBe(200);  const body = (await res.json()) as Record<string, unknown>;  expect(body.resource).toBe(`${BASE}/mcp/toolkits/deploy`);  expect(Array.isArray(body.authorization_servers)).toBe(true);}); test("an unauthenticated /mcp request returns 401 with a WWW-Authenticate challenge", async () => {  const res = await handler(    new Request(`${BASE}/mcp`, {      method: "POST",      headers: {        "content-type": "application/json",        accept: "application/json, text/event-stream",      },      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} }),    }),  );  expect(res.status).toBe(401);  const challenge = res.headers.get("www-authenticate") ?? "";  expect(challenge).toContain("Bearer");  expect(challenge).toContain("resource_metadata=");}); test("an unauthenticated toolkit MCP request challenges with toolkit metadata", async () => {  const res = await handler(    new Request(`${BASE}/mcp/toolkits/deploy`, {      method: "POST",      headers: {        "content-type": "application/json",        accept: "application/json, text/event-stream",      },      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} }),    }),  );  expect(res.status).toBe(401);  const challenge = res.headers.get("www-authenticate") ?? "";  expect(challenge).toContain("Bearer");  expect(challenge).toContain(    `resource_metadata="${BASE}/.well-known/oauth-protected-resource/mcp/toolkits/deploy"`,  );}); // --- End-to-end MCP OAuth: DCR -> authorize -> token -> /mcp with bearer ---const json = async (res: Response) => (await res.json()) as Record<string, unknown>; const signUp = async (email: string): Promise<string> => {  const inviteCode = await mintInviteCode(handler);  const res = await handler(    new Request(`${BASE}/api/auth/sign-up/email`, {      method: "POST",      headers: { "content-type": "application/json" },      body: JSON.stringify({ email, password: "password-12345678", name: email, inviteCode }),    }),  );  expect(res.status).toBe(200);  // The session cookie lets /mcp/authorize skip the interactive login.  return res.headers.get("set-cookie") ?? "";}; const b64url = (buf: Uint8Array): string =>  btoa(String.fromCharCode(...buf))    .replaceAll("+", "-")    .replaceAll("/", "_")    .replaceAll("=", ""); test("MCP OAuth opaque-bearer flow authenticates /mcp end-to-end", async () => {  const cookie = await signUp("oauth@env.test");   // 1. Dynamic client registration (public/PKCE client).  const reg = await handler(    new Request(`${BASE}/api/auth/mcp/register`, {      method: "POST",      headers: { "content-type": "application/json" },      body: JSON.stringify({        client_name: "test-client",        redirect_uris: ["http://localhost:9999/callback"],        token_endpoint_auth_method: "none",        grant_types: ["authorization_code"],        response_types: ["code"],      }),    }),  );  expect([200, 201]).toContain(reg.status);  const clientId = String((await json(reg)).client_id);   // 2. PKCE authorize with the signed-in session cookie. Self-host forces an  // approval screen (prompt=consent injected by the serving layer), so authorize  // does NOT redirect straight to the client callback — it redirects to the  // relative /mcp-consent page carrying a consent_code. A real client's browser  // lands there and the user clicks Allow; we drive that POST directly.  const verifier = b64url(crypto.getRandomValues(new Uint8Array(32)));  const challengeBytes = new Uint8Array(    await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)),  );  const codeChallenge = b64url(challengeBytes);  const authorizeUrl = new URL(`${BASE}/api/auth/mcp/authorize`);  authorizeUrl.search = new URLSearchParams({    response_type: "code",    client_id: clientId,    redirect_uri: "http://localhost:9999/callback",    code_challenge: codeChallenge,    code_challenge_method: "S256",    scope: "openid",  }).toString();  const authorize = await handler(    new Request(authorizeUrl, { headers: { cookie }, redirect: "manual" }),  );  expect(authorize.status).toBe(302);  // Resolve against BASE — the consent redirect is a relative app path.  const consentRedirect = new URL(authorize.headers.get("location") ?? "", BASE);  expect(consentRedirect.pathname).toBe("/mcp-consent");  const consentCode = consentRedirect.searchParams.get("consent_code") ?? "";  expect(consentCode).not.toBe("");   // 2b. Approve on the consent screen — the same POST the /mcp-consent page makes.  // It returns { redirectURI } back to the client's callback carrying the code.  const consent = await handler(    new Request(`${BASE}/api/auth/oauth2/consent`, {      method: "POST",      headers: { "content-type": "application/json", cookie },      body: JSON.stringify({ accept: true, consent_code: consentCode }),    }),  );  expect(consent.status).toBe(200);  const redirectURI = String((await json(consent)).redirectURI ?? "");  const code = new URL(redirectURI).searchParams.get("code") ?? "";  expect(code).not.toBe("");   // 3. Token exchange.  const token = await handler(    new Request(`${BASE}/api/auth/mcp/token`, {      method: "POST",      headers: { "content-type": "application/x-www-form-urlencoded" },      body: new URLSearchParams({        grant_type: "authorization_code",        code,        redirect_uri: "http://localhost:9999/callback",        client_id: clientId,        code_verifier: verifier,      }).toString(),    }),  );  expect(token.status).toBe(200);  const accessToken = String((await json(token)).access_token);  expect(accessToken).not.toBe("");   // 4. The opaque access token authenticates /mcp (initialize succeeds).  const init = await handler(    new Request(`${BASE}/mcp`, {      method: "POST",      headers: {        authorization: `Bearer ${accessToken}`,        "content-type": "application/json",        accept: "application/json, text/event-stream",      },      body: JSON.stringify({        jsonrpc: "2.0",        id: 1,        method: "initialize",        params: {          protocolVersion: "2025-03-26",          capabilities: {},          clientInfo: { name: "t", version: "1" },        },      }),    }),  );  expect(init.status).toBe(200);  expect(init.headers.get("mcp-session-id")).not.toBe(null);});