// Cloud-specific: what a SIGNED-OUT visitor gets at the app's pages.//// Born as the repro for the "bad skeleton on unauthed state" report: the root// AuthGate used to SSR the AUTHENTICATED app-shell skeleton (sidebar + card// grid) for every visitor and only swap to a login page after a client-side// `/account/me` 401 — signed-out users were shown an app they'd never reach.// Now the SSR auth gate (apps/cloud/src/auth/ssr-gate.ts) verifies the sealed// session cookie in the worker and 302s signed-out document requests to// /login (carrying ?returnTo=), so the app shell never exists for them.import { expect } from "@effect/vitest";import { Effect } from "effect"; import { scenario } from "../src/scenario";import { Api, Browser, Target } from "../src/services"; scenario(  "Unauthenticated · the signed-out cloud root lands on /login with no app-shell flash",  {},  Effect.gen(function* () {    const browser = yield* Browser;     // No cookies, no headers → the browser context carries no session.    const anonymous = { label: "anonymous" };     yield* browser.session(anonymous, async ({ page, step }) => {      // Hold the auth probe open: the old bug lived exactly in this window      // (skeleton shown until /account/me resolved). The page must now be      // login-shaped even while it's pending.      await page.route("**/api/account/me", async (route) => {        await new Promise((resolve) => setTimeout(resolve, 1500));        await route.continue();      });       await step("Open the cloud root while signed out → redirected to /login", async () => {        await page.goto("/", { waitUntil: "commit" });        await page.getByText("Sign in to manage your tools and integrations").waitFor();      });       // Snapshot DURING the /account/me window — where the skeleton used to be.      const duringLoading = {        url: new URL(page.url()).pathname,        appShellSkeletons: await page.locator('[data-slot="skeleton"]').count(),        sidebarShown: await page.locator("aside").first().isVisible(),        loginShown: await page          .getByText("Sign in to manage your tools and integrations")          .isVisible(),      };       expect(        duringLoading,        "A signed-out visitor is served the login page directly — never the " +          "authenticated app-shell skeleton (sidebar nav + content-card grid).",      ).toEqual({ url: "/login", appShellSkeletons: 0, sidebarShown: false, loginShown: true });    });  }),); scenario(  "Unauthenticated · a deep link survives login: gate → /login?returnTo → callback lands back on it",  {},  Effect.gen(function* () {    // Gate: the REST API plane is mounted on this target.    yield* Api;    const target = yield* Target;     const cookiePair = (response: Response, name: string): string | undefined => {      for (const header of response.headers.getSetCookie()) {        if (header.startsWith(`${name}=`)) return header.split(";")[0];      }      return undefined;    };     // 1. A signed-out DOCUMENT request for a deep page is redirected to    //    /login carrying the original path.    const gated = yield* Effect.promise(() =>      fetch(new URL("/tools", target.baseUrl), {        redirect: "manual",        headers: { accept: "text/html" },      }),    );    expect(gated.status, "the page itself is never served signed-out").toBe(302);    expect(gated.headers.get("location"), "login knows where the visitor was headed").toBe(      "/login?returnTo=%2Ftools",    );     // Drive /api/auth/login → AuthKit (the emulator signs in headlessly via    // login_hint) → the app's callback, and report where the callback lands    // the signed-in browser. returnTo rides INSIDE the OAuth state param the    // whole way — the state cookie is the only thing the browser carries.    const completeLogin = (loginQuery: string) =>      Effect.promise(async () => {        const login = await fetch(new URL(`/api/auth/login${loginQuery}`, target.baseUrl), {          redirect: "manual",        });        expect(login.status, "login hands the browser to AuthKit").toBe(302);        const stateCookie = cookiePair(login, "wos-login-state");        expect(stateCookie, "the CSRF state is pinned in a cookie").toBeTruthy();         const authorizeUrl = new URL(login.headers.get("location") ?? "");        authorizeUrl.searchParams.set("login_hint", `returnto-${Date.now()}@e2e.test`);        const consent = await fetch(authorizeUrl, { redirect: "manual" });        const callbackUrl = consent.headers.get("location");        expect(callbackUrl, "AuthKit redirects back to the app's callback").toBeTruthy();         const callback = await fetch(callbackUrl!, {          redirect: "manual",          headers: { cookie: stateCookie! },        });        expect(callback.status, "the callback completes the login").toBe(302);        expect(cookiePair(callback, "wos-session"), "a real session cookie is minted").toBeTruthy();        return callback.headers.get("location");      });     // 2. Completing the hosted flow resumes exactly where the gate    //    interrupted the visitor — the deep link, not "/".    const landed = yield* completeLogin("?returnTo=%2Ftools");    expect(landed, "login resumes where the gate interrupted the visitor").toBe("/tools");     // 3. The returnTo channel never becomes an open redirect: an off-origin    //    destination is dropped at the login door, so the flow lands on "/".    const forgedLanding = yield* completeLogin("?returnTo=https%3A%2F%2Fevil.example");    expect(forgedLanding, "an off-origin returnTo falls back to the root").toBe("/");  }),); scenario(  "Unauthenticated · a signed-in session still opens the app shell (the gate lets it through)",  {},  Effect.gen(function* () {    const browser = yield* Browser;    const target = yield* Target;    const identity = yield* target.newIdentity();     yield* browser.session(identity, async ({ page, step }) => {      await step("Open the cloud root signed in", async () => {        await page.goto("/", { waitUntil: "commit" });        await page.locator("aside").first().waitFor({ state: "visible" });      });      expect(new URL(page.url()).pathname, "no login detour for a valid session").toBe("/");    });     // A signed-in visitor landing on /login is bounced back into the app.    const loginWhileSignedIn = yield* Effect.promise(() =>      fetch(new URL("/login", target.baseUrl), {        redirect: "manual",        headers: { accept: "text/html", ...identity.headers },      }),    );    expect(loginWhileSignedIn.status, "/login is for signed-out visitors").toBe(302);    expect(loginWhileSignedIn.headers.get("location")).toBe("/");  }),); scenario(  "Unauthenticated · unknown paths are a real 404 page, not a skeleton or a blank app",  {},  Effect.gen(function* () {    const browser = yield* Browser;    const target = yield* Target;    const identity = yield* target.newIdentity();     yield* browser.session(identity, async ({ page, step }) => {      await step("Open a path that doesn't exist", async () => {        await page.goto("/this-page-does-not-exist", { waitUntil: "commit" });        await page.getByText("Page not found").waitFor();      });      // An unmatched path renders the ROOT route's `notFoundComponent`      // (apps/cloud/src/routes/__root.tsx's `NotFoundPage`), which TanStack      // Router mounts standalone — outside AuthGate's Shell tree entirely, by      // design (see AuthGate's own `urlOrgSlug ? <NotFoundPage /> : ...`      // comment: "framed by nothing — the user isn't 'in' any org here"). It      // was never shell-framed; assert its actual bare shape instead of a      // "Policies" link and shell chrome that no code path has produced since      // NotFoundPage was introduced (#986, commit 5c21c8f9).      expect(        await page.locator('[data-slot="skeleton"]').count(),        "the real 404 page, not a loading skeleton",      ).toBe(0);      expect(        await page.getByRole("link", { name: "Go home" }).isVisible(),        "with the 404 page's action, not a dead end",      ).toBe(true);    });  }),);