import { expect, it } from "@effect/vitest";import { Data, Effect, Layer } from "effect"; import { WorkOSClient, type WorkOSClientService } from "../auth/workos";import { emailResolver } from "./admin-users-api"; // Cloud's REVERSE directory lookup: email -> the WorkOS `user_...` id that the// subject table records in `external_id`.//// WHY THIS IS BUILT ON THE MEMBERSHIP LIST. WorkOS's SDK exposes// `listUsers({ email })`, but the pinned `@executor-js/emulate` WorkOS emulator// serves no list-users route at all — under `/user_management` it has only// `users/:id`, `organization_memberships`, the auth/session routes, and// invitations. A resolver built on `listUsers` would therefore 404 in every// cloud e2e run. So the lookup reuses the SAME membership read the forward// identity join already makes, which the emulator does serve, and scans it in// memory (bounded by org size).//// The membership list is also the authority on who belongs to THIS org, so the// resolver structurally cannot return a user from another tenant — something a// bare `listUsers({ email })` could do. const ORG = "org_placeholder"; /** The failure a real WorkOS read raises for one user. Typed rather than a bare *  `Error`, so the resolver's skip-and-continue behaviour is exercised against *  the shape the client actually fails with. */class WorkOSUnavailable extends Data.TaggedError("WorkOSUnavailable")<{  readonly userId: string;}> {} /** Members of the org, with the casing WorkOS would have stored. WorkOS *  preserves whatever casing a user was created with (and the emulator *  compares byte-exact), so the mixed-case entry is the realistic case. */const DIRECTORY: Record<string, { readonly email: string | null }> = {  user_ada: { email: "Ada@Placeholder.test" },  user_grace: { email: "grace@placeholder.test" },  // A member the directory cannot name: `getUser` succeeds but carries no  // email. It must never match, and must not break the scan for others.  user_nameless: { email: null },}; const stubWorkOS = (calls: string[]) =>  Layer.succeed(    WorkOSClient,    new Proxy({} as WorkOSClientService, {      get: (_target, prop) => {        if (prop === "listOrgMembers") {          return (organizationId: string) => {            calls.push(`listOrgMembers:${organizationId}`);            return Effect.succeed({              data: Object.keys(DIRECTORY).map((userId) => ({ userId, organizationId })),            });          };        }        if (prop === "getUser") {          return (userId: string) => {            calls.push(`getUser:${userId}`);            const user = DIRECTORY[userId];            if (!user) return Effect.die(`unexpected user ${userId}`);            return Effect.succeed(user);          };        }        // A resolver that reaches for any other WorkOS call — notably a        // `listUsers` the emulator cannot serve — is the failure this catches.        return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);      },    }),  ); const resolve = (email: string, calls: string[]) =>  Effect.gen(function* () {    const context = yield* Effect.context<WorkOSClient>();    return yield* emailResolver(ORG, context)(email);  }).pipe(Effect.provide(stubWorkOS(calls))); it.effect("resolves an email to the member's WorkOS user id", () =>  Effect.gen(function* () {    const calls: string[] = [];    // The seam hands the resolver an already-normalized address; the STORED    // value is mixed-case, so this pins that the directory side is normalized    // too. Without that, `Ada@Placeholder.test` would never match.    expect(yield* resolve("ada@placeholder.test", calls)).toBe("user_ada");    expect(calls[0]).toBe(`listOrgMembers:${ORG}`);  }),); it.effect("returns null for an email no member holds", () =>  Effect.gen(function* () {    const calls: string[] = [];    expect(yield* resolve("nobody@placeholder.test", calls)).toBeNull();    // It looked at everyone before saying no, and a member with no email    // neither matched nor derailed the scan.    expect(calls).toContain("getUser:user_nameless");  }),); it.effect("stops fetching once it finds the match", () =>  Effect.gen(function* () {    const calls: string[] = [];    // `user_ada` is first in the member list, so a short-circuiting scan must    // never reach the members behind it. This is what keeps the in-memory scan    // acceptable at the sizes this plane serves.    expect(yield* resolve("ada@placeholder.test", calls)).toBe("user_ada");    expect(calls).not.toContain("getUser:user_grace");    expect(calls).not.toContain("getUser:user_nameless");  }),); it.effect("does not let one unreadable member hide the real match", () =>  Effect.gen(function* () {    const calls: string[] = [];    const failing = Layer.succeed(      WorkOSClient,      new Proxy({} as WorkOSClientService, {        get: (_target, prop) => {          if (prop === "listOrgMembers") {            return () =>              Effect.succeed({                data: [{ userId: "user_broken" }, { userId: "user_grace" }],              });          }          if (prop === "getUser") {            return (userId: string) => {              calls.push(userId);              return userId === "user_broken"                ? Effect.fail(new WorkOSUnavailable({ userId }))                : Effect.succeed(DIRECTORY[userId]!);            };          }          return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);        },      }),    );     const resolved = yield* Effect.gen(function* () {      const context = yield* Effect.context<WorkOSClient>();      return yield* emailResolver(ORG, context)("grace@placeholder.test");    }).pipe(Effect.provide(failing));     expect(resolved, "an unreadable member is skipped, not fatal").toBe("user_grace");    expect(calls).toEqual(["user_broken", "user_grace"]);  }),);