import { randomBytes } from "node:crypto"; import { expect } from "@effect/vitest";import { Effect } from "effect";import { composePluginApi } from "@executor-js/api/server";import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";import { AuthTemplateSlug, ConnectionName, decodeOAuthCallbackState, IntegrationSlug, OAuthClientSlug,} from "@executor-js/sdk/shared";import { serveOAuthTestServer } from "@executor-js/sdk/testing"; import { scenario } from "../src/scenario";import { Api, Target } from "../src/services"; const api = composePluginApi([openApiHttpPlugin()] as const); const unique = (prefix: string) => `${prefix}_${randomBytes(4).toString("hex")}`; const oauthIntegrationSpec = (oauth: { readonly authorizationEndpoint: string; readonly tokenEndpoint: string;}) => ({ spec: { kind: "blob" as const, value: JSON.stringify({ openapi: "3.0.3", info: { title: "OAuth-protected API", version: "1.0.0" }, paths: { "/me": { get: { operationId: "getMe", tags: ["default"], responses: { "200": { description: "the caller" } }, }, }, }, }), }, baseUrl: "http://127.0.0.1:59999", authenticationTemplate: [ { slug: "oauth", kind: "oauth2" as const, authorizationUrl: oauth.authorizationEndpoint, tokenUrl: oauth.tokenEndpoint, scopes: ["read"], }, ], }) as const; // Better Auth email sign-in → session cookie, so the callback (a browser GET// behind the session) can be driven with a plain authenticated fetch. Mirrors// what the API surface does internally; kept local to keep this a black-box HTTP// journey with no browser dependency.const sessionCookie = (baseUrl: string, credentials: { email: string; password: string }) => Effect.promise(async () => { const response = await fetch(new URL("/api/auth/sign-in/email", baseUrl), { method: "POST", headers: { "content-type": "application/json", origin: new URL(baseUrl).origin }, body: JSON.stringify(credentials), }); const cookie = (response.headers.getSetCookie?.() ?? []).map((c) => c.split(";")[0]).join("; "); if (!cookie) throw new Error(`sign-in set no cookie (${response.status})`); return cookie; }); // Regression guard for the org-wrapped callback state. Self-host binds every// request to an org slug ("default"), so `oauth.start` wraps the raw session// token in the state it sends the provider. The provider echoes that wrapped// value back on the callback; the shared popup callback must unwrap it to the// raw token before looking up the session. Before the fix it passed the wrapped// value straight to `oauth.complete`, which looks up by the raw token and failed// with "OAuth session expired or not found".scenario( "OAuth callback · a self-host org-context popup callback completes with the wrapped state", {}, Effect.gen(function* () { const target = yield* Target; const { client: makeApiClient } = yield* Api; const oauth = yield* serveOAuthTestServer(); const identity = yield* target.newIdentity(); const client = yield* makeApiClient(api, identity); const integration = IntegrationSlug.make(unique("selfhostorgstate")); yield* client.openapi.addSpec({ payload: { ...oauthIntegrationSpec(oauth), slug: integration }, }); const clientSlug = OAuthClientSlug.make(unique("selfhostorgstate")); yield* client.oauth.createClient({ payload: { owner: "org", slug: clientSlug, authorizationUrl: oauth.authorizationEndpoint, tokenUrl: oauth.tokenEndpoint, grant: "authorization_code", clientId: "test-client", clientSecret: "test-secret", }, }); const started = yield* client.oauth.start({ payload: { client: clientSlug, clientOwner: "org", owner: "org", name: ConnectionName.make("main"), integration, template: AuthTemplateSlug.make("oauth"), }, }); expect(started.status, "oauth.start begins at the provider").toBe("redirect"); const authorizationUrl = started.status === "redirect" ? started.authorizationUrl : ""; // The bug's precondition: the state sent to the provider is NOT the raw // session token, it is the org-slug-wrapped envelope. If this stops being // true the callback path below no longer exercises the regression. const providerState = new URL(authorizationUrl).searchParams.get("state") ?? ""; expect( decodeOAuthCallbackState(providerState), "self-host org context wraps the OAuth state with the org slug before redirecting", ).not.toBeNull(); const authorize = yield* Effect.promise(() => fetch(authorizationUrl, { redirect: "manual" })); expect(authorize.status, "the provider asks the user to log in").toBe(302); const consent = yield* Effect.promise(() => fetch(authorize.headers.get("location") ?? "", { method: "POST", redirect: "manual", headers: { authorization: `Basic ${Buffer.from("alice:password").toString("base64")}`, }, }), ); expect(consent.status, "provider consent redirects back to Executor").toBe(302); const callback = new URL(consent.headers.get("location") ?? ""); const callbackPath = `${callback.pathname}${callback.search}`; expect( callback.searchParams.get("state"), "the provider echoes the wrapped state back on the callback", ).toBe(providerState); const cookie = yield* sessionCookie(target.baseUrl, identity.credentials!); const response = yield* Effect.promise(() => fetch(new URL(callbackPath, target.baseUrl), { headers: { cookie } }), ); expect(response.status, "the callback renders its popup HTML").toBe(200); const html = yield* Effect.promise(() => response.text()); expect( html, "the wrapped state is unwrapped to the raw token, so the session is found and completes", ).toContain("Connected"); expect( html, "the raw session token is recovered from the wrapped state (no expired-session error)", ).not.toContain("OAuth session expired or not found"); }).pipe(Effect.scoped),);
import { randomBytes } from "node:crypto";
import { expect } from "@effect/vitest";
import { Effect } from "effect";
import { composePluginApi } from "@executor-js/api/server";
import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
import {
AuthTemplateSlug,
ConnectionName,
decodeOAuthCallbackState,
IntegrationSlug,
OAuthClientSlug,
} from "@executor-js/sdk/shared";
import { serveOAuthTestServer } from "@executor-js/sdk/testing";
import { scenario } from "../src/scenario";
import { Api, Target } from "../src/services";
const api = composePluginApi([openApiHttpPlugin()] as const);
const unique = (prefix: string) => `${prefix}_${randomBytes(4).toString("hex")}`;
const oauthIntegrationSpec = (oauth: {
readonly authorizationEndpoint: string;
readonly tokenEndpoint: string;
}) =>
({
spec: {
kind: "blob" as const,
value: JSON.stringify({
openapi: "3.0.3",
info: { title: "OAuth-protected API", version: "1.0.0" },
paths: {
"/me": {
get: {
operationId: "getMe",
tags: ["default"],
responses: { "200": { description: "the caller" } },
},
},
},
}),
},
baseUrl: "http://127.0.0.1:59999",
authenticationTemplate: [
{
slug: "oauth",
kind: "oauth2" as const,
authorizationUrl: oauth.authorizationEndpoint,
tokenUrl: oauth.tokenEndpoint,
scopes: ["read"],
},
],
}) as const;
// Better Auth email sign-in → session cookie, so the callback (a browser GET
// behind the session) can be driven with a plain authenticated fetch. Mirrors
// what the API surface does internally; kept local to keep this a black-box HTTP
// journey with no browser dependency.
const sessionCookie = (baseUrl: string, credentials: { email: string; password: string }) =>
Effect.promise(async () => {
const response = await fetch(new URL("/api/auth/sign-in/email", baseUrl), {
method: "POST",
headers: { "content-type": "application/json", origin: new URL(baseUrl).origin },
body: JSON.stringify(credentials),
});
const cookie = (response.headers.getSetCookie?.() ?? []).map((c) => c.split(";")[0]).join("; ");
if (!cookie) throw new Error(`sign-in set no cookie (${response.status})`);
return cookie;
});
// Regression guard for the org-wrapped callback state. Self-host binds every
// request to an org slug ("default"), so `oauth.start` wraps the raw session
// token in the state it sends the provider. The provider echoes that wrapped
// value back on the callback; the shared popup callback must unwrap it to the
// raw token before looking up the session. Before the fix it passed the wrapped
// value straight to `oauth.complete`, which looks up by the raw token and failed
// with "OAuth session expired or not found".
scenario(
"OAuth callback · a self-host org-context popup callback completes with the wrapped state",
{},
Effect.gen(function* () {
const target = yield* Target;
const { client: makeApiClient } = yield* Api;
const oauth = yield* serveOAuthTestServer();
const identity = yield* target.newIdentity();
const client = yield* makeApiClient(api, identity);
const integration = IntegrationSlug.make(unique("selfhostorgstate"));
yield* client.openapi.addSpec({
payload: { ...oauthIntegrationSpec(oauth), slug: integration },
});
const clientSlug = OAuthClientSlug.make(unique("selfhostorgstate"));
yield* client.oauth.createClient({
payload: {
owner: "org",
slug: clientSlug,
authorizationUrl: oauth.authorizationEndpoint,
tokenUrl: oauth.tokenEndpoint,
grant: "authorization_code",
clientId: "test-client",
clientSecret: "test-secret",
},
});
const started = yield* client.oauth.start({
payload: {
client: clientSlug,
clientOwner: "org",
owner: "org",
name: ConnectionName.make("main"),
integration,
template: AuthTemplateSlug.make("oauth"),
},
});
expect(started.status, "oauth.start begins at the provider").toBe("redirect");
const authorizationUrl = started.status === "redirect" ? started.authorizationUrl : "";
// The bug's precondition: the state sent to the provider is NOT the raw
// session token, it is the org-slug-wrapped envelope. If this stops being
// true the callback path below no longer exercises the regression.
const providerState = new URL(authorizationUrl).searchParams.get("state") ?? "";
expect(
decodeOAuthCallbackState(providerState),
"self-host org context wraps the OAuth state with the org slug before redirecting",
).not.toBeNull();
const authorize = yield* Effect.promise(() => fetch(authorizationUrl, { redirect: "manual" }));
expect(authorize.status, "the provider asks the user to log in").toBe(302);
const consent = yield* Effect.promise(() =>
fetch(authorize.headers.get("location") ?? "", {
method: "POST",
redirect: "manual",
headers: {
authorization: `Basic ${Buffer.from("alice:password").toString("base64")}`,
},
}),
);
expect(consent.status, "provider consent redirects back to Executor").toBe(302);
const callback = new URL(consent.headers.get("location") ?? "");
const callbackPath = `${callback.pathname}${callback.search}`;
expect(
callback.searchParams.get("state"),
"the provider echoes the wrapped state back on the callback",
).toBe(providerState);
const cookie = yield* sessionCookie(target.baseUrl, identity.credentials!);
const response = yield* Effect.promise(() =>
fetch(new URL(callbackPath, target.baseUrl), { headers: { cookie } }),
);
expect(response.status, "the callback renders its popup HTML").toBe(200);
const html = yield* Effect.promise(() => response.text());
expect(
html,
"the wrapped state is unwrapped to the raw token, so the session is found and completes",
).toContain("Connected");
expect(
html,
"the raw session token is recovered from the wrapped state (no expired-session error)",
).not.toContain("OAuth session expired or not found");
}).pipe(Effect.scoped),
);