// ---------------------------------------------------------------------------// Tests for OAuth2 flow extraction in previewSpec. Covers://   - authorizationCode flow extraction (URLs + scopes)//   - clientCredentials flow extraction//   - security schemes defined via $ref are no longer silently dropped//   - bearerFormat / openIdConnectUrl are captured//   - invalid flows (missing tokenUrl) are ignored// --------------------------------------------------------------------------- import { describe, expect, it } from "@effect/vitest";import { Effect, Option, Schema } from "effect";import { FetchHttpClient } from "effect/unstable/http";import { HttpApi, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"; import { previewSpec as previewSpecRaw } from "./preview"; const previewSpec = (input: string) =>  previewSpecRaw(input).pipe(Effect.provide(FetchHttpClient.layer)); const PreviewGroup = HttpApiGroup.make("default", { topLevel: true }).add(  HttpApiEndpoint.get("ping", "/ping", { success: Schema.Unknown }),); const PreviewApi = HttpApi.make("previewOauth2Test")  .add(PreviewGroup)  .annotateMerge(    OpenApi.annotations({      title: "Test API",      version: "1.0.0",      servers: [{ url: "https://api.example.com" }],    }),  ); const minimalSpec = (  securitySchemes: Record<string, unknown>,  components: Record<string, unknown> = {},) =>  OpenApi.fromApi(    PreviewApi.annotateMerge(      OpenApi.annotations({        transform: (spec) => ({          ...spec,          components: { ...components, securitySchemes },        }),      }),    ),  ); describe("previewSpec OAuth2 extraction", () => {  it.effect("extracts authorizationCode flow with URLs, scopes, refreshUrl", () =>    Effect.gen(function* () {      const spec = minimalSpec({        oauth_app: {          type: "oauth2",          flows: {            authorizationCode: {              authorizationUrl: "https://example.com/oauth/authorize",              tokenUrl: "https://example.com/oauth/token",              refreshUrl: "https://example.com/oauth/refresh",              scopes: {                read: "Read access",                write: "Write access",              },            },          },        },      });      const preview = yield* previewSpec(JSON.stringify(spec));       expect(preview.securitySchemes).toHaveLength(1);      const scheme = preview.securitySchemes[0]!;      expect(scheme.name).toBe("oauth_app");      expect(scheme.type).toBe("oauth2");      expect(Option.isSome(scheme.flows)).toBe(true);      const flows = Option.getOrThrow(scheme.flows);      expect(Option.isSome(flows.authorizationCode)).toBe(true);      const flow = Option.getOrThrow(flows.authorizationCode);      expect(flow.authorizationUrl).toBe("https://example.com/oauth/authorize");      expect(flow.tokenUrl).toBe("https://example.com/oauth/token");      expect(Option.getOrElse(flow.refreshUrl, () => "")).toBe("https://example.com/oauth/refresh");      expect(flow.scopes).toEqual({        read: "Read access",        write: "Write access",      });       // A preset should be generated for this flow.      expect(preview.oauth2Presets).toHaveLength(1);      expect(preview.headerPresets).toHaveLength(0);      const preset = preview.oauth2Presets[0]!;      expect(preset.flow).toBe("authorizationCode");      expect(preset.securitySchemeName).toBe("oauth_app");      expect(preset.tokenUrl).toBe("https://example.com/oauth/token");      expect(preset.label).toContain("Authorization Code");      expect(preset.label).toContain("oauth_app");      expect(preset.scopes).toEqual({        read: "Read access",        write: "Write access",      });      expect(preset.identityScopes).toBe("auto");    }),  );   it.effect("extracts clientCredentials flow alongside authorizationCode", () =>    Effect.gen(function* () {      const spec = minimalSpec({        oauth_app: {          type: "oauth2",          flows: {            authorizationCode: {              authorizationUrl: "https://example.com/auth",              tokenUrl: "https://example.com/token",              scopes: {},            },            clientCredentials: {              tokenUrl: "https://example.com/token",              scopes: { "admin:read": "Admin read" },            },          },        },      });      const preview = yield* previewSpec(JSON.stringify(spec));       expect(preview.oauth2Presets).toHaveLength(2);      const flowKinds = preview.oauth2Presets.map((p) => p.flow).sort();      expect(flowKinds).toEqual(["authorizationCode", "clientCredentials"]);       const cc = preview.oauth2Presets.find((p) => p.flow === "clientCredentials")!;      expect(Option.isNone(cc.authorizationUrl)).toBe(true);      expect(cc.scopes).toEqual({ "admin:read": "Admin read" });      expect(cc.identityScopes).toBe(false);    }),  );   it.effect("skips authorizationCode flow missing tokenUrl or authorizationUrl", () =>    Effect.gen(function* () {      const spec = minimalSpec({        broken: {          type: "oauth2",          flows: {            authorizationCode: {              authorizationUrl: "https://example.com/auth",              // tokenUrl missing              scopes: {},            },          },        },      });      const preview = yield* previewSpec(JSON.stringify(spec));       expect(preview.securitySchemes).toHaveLength(1);      // Scheme is still captured but with no flows.      expect(Option.isNone(preview.securitySchemes[0]!.flows)).toBe(true);      expect(preview.oauth2Presets).toHaveLength(0);    }),  );   it.effect("resolves security schemes defined via $ref", () =>    Effect.gen(function* () {      const spec = minimalSpec({        api_token: { $ref: "#/components/securitySchemes/_api_token_impl" },        _api_token_impl: {          type: "http",          scheme: "bearer",          bearerFormat: "JWT",          description: "Internal token scheme",        },      });      // Note: `api_token` should resolve through the sibling      // `_api_token_impl` scheme in `components.securitySchemes`.       const preview = yield* previewSpec(JSON.stringify(spec));      // Both keys are present, but the `api_token` entry should resolve to      // the http bearer scheme (previously it was silently dropped).      const apiToken = preview.securitySchemes.find((s) => s.name === "api_token");      expect(apiToken).toBeDefined();      expect(apiToken!.type).toBe("http");      expect(Option.getOrElse(apiToken!.scheme, () => "")).toBe("bearer");      expect(Option.getOrElse(apiToken!.bearerFormat, () => "")).toBe("JWT");    }),  );  it.effect("captures openIdConnectUrl for openIdConnect schemes", () =>    Effect.gen(function* () {      const spec = minimalSpec({        oidc: {          type: "openIdConnect",          openIdConnectUrl: "https://example.com/.well-known/openid-configuration",        },      });      const preview = yield* previewSpec(JSON.stringify(spec));      const scheme = preview.securitySchemes[0]!;      expect(scheme.type).toBe("openIdConnect");      expect(Option.getOrElse(scheme.openIdConnectUrl, () => "")).toBe(        "https://example.com/.well-known/openid-configuration",      );    }),  );});