// Cloud-only: the tenant partition itself. The per-request executor binds the// caller's organization from auth — a request can't even NAME a foreign org —// so the invariant is that everything written under one org (integrations,// tools, connections, secret values) is simply invisible from another org, and// that the same integration slug in two orgs is two independent records.import { randomBytes } from "node:crypto"; import { expect } from "@effect/vitest";import { Effect } from "effect";import type { HttpApiClient } from "effect/unstable/httpapi";import { composePluginApi } from "@executor-js/api/server";import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";import { AuthTemplateSlug, ConnectionName, IntegrationSlug } from "@executor-js/sdk/shared"; import { scenario } from "../src/scenario";import { Api, Target } from "../src/services"; const api = composePluginApi([openApiHttpPlugin()] as const);type Client = HttpApiClient.ForApi<typeof api>; const TEMPLATE_API_KEY = AuthTemplateSlug.make("apiKey"); /** Minimal OpenAPI spec with a single GET /ping — never contacted here. */const pingSpec = JSON.stringify({ openapi: "3.0.3", info: { title: "Ping API", version: "1.0.0" }, paths: { "/ping": { get: { operationId: "ping", summary: "Ping", responses: { "200": { description: "pong" } } }, }, },}); const addPingSpec = (client: Client, slug: IntegrationSlug, description?: string) => client.openapi.addSpec({ payload: { spec: { kind: "blob", value: pingSpec }, slug, ...(description === undefined ? {} : { description }), baseUrl: "http://127.0.0.1:59999", // never contacted during registration authenticationTemplate: [ { slug: "apiKey", type: "apiKey", headers: { authorization: ["Bearer ", { type: "variable", name: "token" }] }, }, ], }, }); scenario( "Tenant isolation · integrations, tools, and connections in one org are invisible to another", {}, Effect.gen(function* () { const target = yield* Target; const { client } = yield* Api; const orgA = yield* target.newIdentity(); const orgB = yield* target.newIdentity(); const clientA = yield* client(api, orgA); const clientB = yield* client(api, orgB); const slug = IntegrationSlug.make(`tenant-scn-${randomBytes(4).toString("hex")}`); const connectionName = ConnectionName.make(`tenantconn${randomBytes(4).toString("hex")}`); const secretValue = `tenant-secret-${randomBytes(8).toString("hex")}`; // Org A registers an integration and stores a credential against it. yield* addPingSpec(clientA, slug); yield* clientA.connections.create({ payload: { owner: "org", name: connectionName, integration: slug, template: TEMPLATE_API_KEY, value: secretValue, }, }); // Sanity from org A's own side: the integration is really there. const aIntegrations = yield* clientA.integrations.list(); expect( aIntegrations.map((integration) => integration.slug), "org A sees its own integration", ).toContain(slug); // Org B sees none of it — catalog, tools, connections, or secret bytes. const bIntegrations = yield* clientB.integrations.list(); expect( bIntegrations.map((integration) => integration.slug), "org B's integration catalog has no trace of org A's integration", ).not.toContain(slug); const bTools = yield* clientB.tools.list({ query: {} }); const leakedTools = bTools .filter((tool) => String(tool.address).includes(slug)) .map((tool) => tool.address); expect(leakedTools, "no org-A tool leaks into org B's tool catalog").toEqual([]); const bView = yield* clientB.openapi.getIntegration({ params: { slug } }); expect(bView, "fetching org A's integration by slug from org B yields nothing").toBeNull(); const bConnections = yield* clientB.connections.list({ query: {} }); expect( bConnections.map((connection) => connection.name), "org A's connection is not in org B's connection list", ).not.toContain(connectionName); expect( JSON.stringify(bConnections), "org A's secret value appears nowhere in org B's view", ).not.toContain(secretValue); }),); scenario( "Tenant isolation · the same integration slug in two orgs is two independent records", {}, Effect.gen(function* () { const target = yield* Target; const { client } = yield* Api; const orgA = yield* target.newIdentity(); const orgB = yield* target.newIdentity(); const clientA = yield* client(api, orgA); const clientB = yield* client(api, orgB); // Both orgs register the SAME slug — neither blocks the other. const slug = IntegrationSlug.make(`shared-scn-${randomBytes(4).toString("hex")}`); yield* addPingSpec(clientA, slug, "Org A API"); yield* addPingSpec(clientB, slug, "Org B API"); // Updating org A's record must not mutate org B's same-slug record. yield* clientA.integrations.update({ params: { slug }, payload: { description: "Org A Updated API" }, }); const aIntegration = yield* clientA.integrations.get({ params: { slug } }); const bIntegration = yield* clientB.integrations.get({ params: { slug } }); expect(aIntegration.description, "org A sees its own update").toBe("Org A Updated API"); expect(bIntegration.description, "org B's same-slug record is untouched").toBe("Org B API"); }),);
// Cloud-only: the tenant partition itself. The per-request executor binds the
// caller's organization from auth — a request can't even NAME a foreign org —
// so the invariant is that everything written under one org (integrations,
// tools, connections, secret values) is simply invisible from another org, and
// that the same integration slug in two orgs is two independent records.
import { randomBytes } from "node:crypto";
import { expect } from "@effect/vitest";
import { Effect } from "effect";
import type { HttpApiClient } from "effect/unstable/httpapi";
import { composePluginApi } from "@executor-js/api/server";
import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
import { AuthTemplateSlug, ConnectionName, IntegrationSlug } from "@executor-js/sdk/shared";
import { scenario } from "../src/scenario";
import { Api, Target } from "../src/services";
const api = composePluginApi([openApiHttpPlugin()] as const);
type Client = HttpApiClient.ForApi<typeof api>;
const TEMPLATE_API_KEY = AuthTemplateSlug.make("apiKey");
/** Minimal OpenAPI spec with a single GET /ping — never contacted here. */
const pingSpec = JSON.stringify({
openapi: "3.0.3",
info: { title: "Ping API", version: "1.0.0" },
paths: {
"/ping": {
get: { operationId: "ping", summary: "Ping", responses: { "200": { description: "pong" } } },
},
},
});
const addPingSpec = (client: Client, slug: IntegrationSlug, description?: string) =>
client.openapi.addSpec({
payload: {
spec: { kind: "blob", value: pingSpec },
slug,
...(description === undefined ? {} : { description }),
baseUrl: "http://127.0.0.1:59999", // never contacted during registration
authenticationTemplate: [
{
slug: "apiKey",
type: "apiKey",
headers: { authorization: ["Bearer ", { type: "variable", name: "token" }] },
},
],
},
});
scenario(
"Tenant isolation · integrations, tools, and connections in one org are invisible to another",
{},
Effect.gen(function* () {
const target = yield* Target;
const { client } = yield* Api;
const orgA = yield* target.newIdentity();
const orgB = yield* target.newIdentity();
const clientA = yield* client(api, orgA);
const clientB = yield* client(api, orgB);
const slug = IntegrationSlug.make(`tenant-scn-${randomBytes(4).toString("hex")}`);
const connectionName = ConnectionName.make(`tenantconn${randomBytes(4).toString("hex")}`);
const secretValue = `tenant-secret-${randomBytes(8).toString("hex")}`;
// Org A registers an integration and stores a credential against it.
yield* addPingSpec(clientA, slug);
yield* clientA.connections.create({
payload: {
owner: "org",
name: connectionName,
integration: slug,
template: TEMPLATE_API_KEY,
value: secretValue,
},
});
// Sanity from org A's own side: the integration is really there.
const aIntegrations = yield* clientA.integrations.list();
expect(
aIntegrations.map((integration) => integration.slug),
"org A sees its own integration",
).toContain(slug);
// Org B sees none of it — catalog, tools, connections, or secret bytes.
const bIntegrations = yield* clientB.integrations.list();
expect(
bIntegrations.map((integration) => integration.slug),
"org B's integration catalog has no trace of org A's integration",
).not.toContain(slug);
const bTools = yield* clientB.tools.list({ query: {} });
const leakedTools = bTools
.filter((tool) => String(tool.address).includes(slug))
.map((tool) => tool.address);
expect(leakedTools, "no org-A tool leaks into org B's tool catalog").toEqual([]);
const bView = yield* clientB.openapi.getIntegration({ params: { slug } });
expect(bView, "fetching org A's integration by slug from org B yields nothing").toBeNull();
const bConnections = yield* clientB.connections.list({ query: {} });
expect(
bConnections.map((connection) => connection.name),
"org A's connection is not in org B's connection list",
).not.toContain(connectionName);
expect(
JSON.stringify(bConnections),
"org A's secret value appears nowhere in org B's view",
).not.toContain(secretValue);
}),
);
scenario(
"Tenant isolation · the same integration slug in two orgs is two independent records",
{},
Effect.gen(function* () {
const target = yield* Target;
const { client } = yield* Api;
const orgA = yield* target.newIdentity();
const orgB = yield* target.newIdentity();
const clientA = yield* client(api, orgA);
const clientB = yield* client(api, orgB);
// Both orgs register the SAME slug — neither blocks the other.
const slug = IntegrationSlug.make(`shared-scn-${randomBytes(4).toString("hex")}`);
yield* addPingSpec(clientA, slug, "Org A API");
yield* addPingSpec(clientB, slug, "Org B API");
// Updating org A's record must not mutate org B's same-slug record.
yield* clientA.integrations.update({
params: { slug },
payload: { description: "Org A Updated API" },
});
const aIntegration = yield* clientA.integrations.get({ params: { slug } });
const bIntegration = yield* clientB.integrations.get({ params: { slug } });
expect(aIntegration.description, "org A sees its own update").toBe("Org A Updated API");
expect(bIntegration.description, "org B's same-slug record is untouched").toBe("Org B API");
}),
);