// ---------------------------------------------------------------------------// Focused tests — the WorkOS login callback's CSRF gate.//// Codes without state restart login without a WorkOS exchange; a replayed// state still fails with 400; a fresh state matching the cookie issues a session.//// Test seams follow repo conventions: @effect/vitest, Layer.succeed stubs// (see org-selector-auth.node.test.ts), and HttpRouter.toWebHandler for the// HTTP surface (see api.request-scope.node.test.ts).// --------------------------------------------------------------------------- import { afterAll, describe, expect, it, vi } from "@effect/vitest";import { waitUntil } from "cloudflare:workers";import { Effect, Layer } from "effect";import { HttpRouter, HttpServer } from "effect/unstable/http";import { HttpApiBuilder } from "effect/unstable/httpapi";import { HttpApi } from "effect/unstable/httpapi"; import { MemberDirectory } from "@executor-js/api/server"; import { CloudAuthPublicHandlers } from "./handlers";import { CloudAuthPublicApi } from "./api";import { UserStoreService } from "./context";import { WorkOSClient, type WorkOSClientService } from "./workos";import { WorkOsMirror } from "./workos-mirror";import { encodeLoginState } from "./login-state";import { AutumnService } from "../extensions/billing/service"; // The route under test serves under the `/api` prefix in the composed app;// toWebHandler mounts the raw group, so paths here are relative to the group.const SESSION_COOKIE = "wos-session";const STATE_COOKIE = "wos-login-state"; const STUB_USER_ID = "user_test";const STUB_SESSION = "sealed-session-stub";const STUB_ORG_ID = "org_test"; const stubWorkOS = Layer.succeed(  WorkOSClient,  new Proxy({} as WorkOSClientService, {    get: (_t, prop) => {      if (prop === "authenticateWithCode") {        return (code: string) =>          code === "unbound-code"            ? Effect.die("An unbound authorization code must never be exchanged")            : Effect.succeed({                user: { id: STUB_USER_ID, email: "u@test" },                organizationId: STUB_ORG_ID,                sealedSession: STUB_SESSION,              });      }      if (prop === "listUserMemberships") {        return () => Effect.succeed({ data: [] });      }      return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);    },  }),); // A bare account row, as `ensureAccount` mints it before any WorkOS profile// has been mirrored onto it.const bareAccount = (id: string) => ({  id,  email: null,  firstName: null,  lastName: null,  avatarUrl: null,  workosUpdatedAt: null,  lastSignInAt: null,  createdAt: new Date(),}); const stubUsers = Layer.succeed(UserStoreService)({  use: (_op, fn) =>    Effect.promise(() =>      fn({        ensureAccount: async (id: string) => bareAccount(id),        getAccount: async (id: string) => bareAccount(id),        upsertOrganization: async (org: { id: string; name: string }) => ({          ...org,          slug: org.id,          backfilledAt: null,          deletedAt: null,          workosUpdatedAt: null,          createdAt: new Date(),        }),        getOrganization: async (id: string) => ({          id,          name: "Org " + id,          slug: id,          backfilledAt: null,          deletedAt: null,          workosUpdatedAt: null,          createdAt: new Date(),        }),        getOrganizationBySlug: async (slug: string) => ({          id: slug,          name: slug,          slug,          backfilledAt: null,          deletedAt: null,          workosUpdatedAt: null,          createdAt: new Date(),        }),        markOrganizationDeleted: async () => null,        deleteOrganizationCascade: async () => {},      }),    ),}); // The callback records the sign-in (user + memberships) in the membership// mirror, and its forked seat recount reads the backfill marker and the// landed org's active members from it; every other operation is out of this// route's reach.const stubMirror = Layer.succeed(WorkOsMirror)({  upsertUser: () => Effect.succeed(true),  upsertMembership: () => Effect.succeed(true),  deleteMembership: () => Effect.die("the callback does not delete memberships"),  deleteUser: () => Effect.die("the callback does not delete users"),  getCursor: () => Effect.die("the callback does not read the events cursor"),  applyPage: () => Effect.die("the callback does not move the events cursor"),  applyOrganizationScan: () => Effect.die("the callback does not run the backfill"),  replayBoundary: () => Effect.die("the callback does not run the reconciler"),  setReplayBoundary: () => Effect.die("the callback does not run the backfill"),  backfillCompletedAt: () => Effect.die("the callback does not check mirror readiness"),  markBackfillCompleted: () => Effect.die("the callback does not run the backfill"),  drainedAt: () => Effect.die("the callback does not check mirror readiness"),  markDrained: () => Effect.die("the callback does not run the reconciler"),  organizationBackfilledAt: () => Effect.succeed(new Date()),}); const stubDirectory = Layer.succeed(MemberDirectory)({  membership: () => Effect.die("the callback does not look up one membership"),  membershipById: () => Effect.die("the callback does not look up by membership id"),  membershipsOf: () => Effect.die("the callback reads the WorkOS list, not the mirror's"),  membersById: () => Effect.die("the callback does not batch members"),  findByEmail: () => Effect.die("the callback does not resolve emails"),  members: (organizationId) =>    Effect.succeed([      {        accountId: STUB_USER_ID,        membershipId: `om_${STUB_USER_ID}`,        organizationId,        email: null,        name: null,        avatarUrl: null,        role: "member",        status: "active" as const,        lastActiveAt: null,      },    ]),}); // Only the public group is under test; the session group (and its SessionAuth// middleware, which needs a live DB) is out of scope — the callback route lives// in CloudAuthPublicApi and requires no middleware.const PublicApi = HttpApi.make("cloudWeb").add(CloudAuthPublicApi); const App = HttpApiBuilder.layer(PublicApi).pipe(  Layer.provide(CloudAuthPublicHandlers),  Layer.provide(stubWorkOS),  Layer.provide(stubUsers),  Layer.provide(stubMirror),  Layer.provide(stubDirectory),  Layer.provide(AutumnService.Default),  Layer.provide(HttpServer.layerServices),); const app = HttpRouter.toWebHandler(App, { disableLogger: true });afterAll(async () => {  await Promise.all(vi.mocked(waitUntil).mock.calls.map(([work]) => work));  await app.dispose();}); const run = (request: Request) => {  // beta.59: the handler type expects a context argument; this layer stack  // needs none at runtime — pass undefined like the api.request-scope tests.  return app.handler(request, undefined as never);}; const callbackUrl = (state?: string, code = "code_1") =>  `https://executor.test/auth/callback${state ? `?state=${encodeURIComponent(state)}` : ""}${state ? "&" : "?"}code=${code}`; describe("workos callback · CSRF state hardening", () => {  for (const returnTo of ["/\\evil.example", "/safe/../api/auth/me"]) {    it(`keeps an unsafe return destination on the homepage: ${JSON.stringify(returnTo)}`, async () => {      const state = encodeLoginState({ nonce: "redirect-boundary", returnTo });      const res = await run(        new Request(callbackUrl(state), {          headers: { cookie: `${STATE_COOKIE}=${state}` },          redirect: "manual",        }),      );      expect(res.status).toBe(302);      expect(res.headers.get("location")).toBe("/");      expect(res.headers.get("set-cookie") ?? "").toContain(SESSION_COOKIE);    });  }   it("restarts login without exchanging a code that has no state", async () => {    const res = await run(      new Request(callbackUrl(undefined, "unbound-code"), { redirect: "manual" }),    );    expect(res.status).toBe(302);    expect(res.headers.get("location")).toBe("/api/auth/login");    expect(res.headers.get("set-cookie") ?? "").not.toContain(SESSION_COOKIE);  });   it("discards an existing login cookie when restarting a callback without state", async () => {    const res = await run(      new Request(callbackUrl(undefined, "unbound-code"), {        headers: { cookie: `${STATE_COOKIE}=victim-login-state` },        redirect: "manual",      }),    );    expect(res.status).toBe(302);    expect(res.headers.get("location")).toBe("/api/auth/login");    expect(res.headers.get("set-cookie")).toContain(`${STATE_COOKIE}=; Max-Age=0`);    expect(res.headers.get("set-cookie") ?? "").not.toContain(SESSION_COOKIE);  });   it("rejects empty state instead of treating it as a provider-initiated login", async () => {    const res = await run(new Request(`${callbackUrl(undefined, "unbound-code")}&state=`));    expect(res.status).toBe(400);    expect(await res.text()).toBe("Invalid login state");    expect(res.headers.get("set-cookie") ?? "").not.toContain(SESSION_COOKIE);  });   it("rejects a state that does not match the login cookie", async () => {    const res = await run(      new Request(callbackUrl("attacker-controlled-state"), {        headers: { cookie: `${STATE_COOKIE}=victim-login-state` },        redirect: "manual",      }),    );    expect(res.status).toBe(400);    expect(await res.text()).toContain("Invalid login state");  });   it("accepts a fresh state matching the cookie and issues a session (302 + cookie)", async () => {    // /login sets the cookie; simulate its value for this callback.    const state = encodeLoginState({ nonce: "nonce-123", returnTo: "/" });    const res = await run(      new Request(callbackUrl(state), {        headers: { cookie: `${STATE_COOKIE}=${state}` },        redirect: "manual",      }),    );    expect(res.status).toBe(302);    expect(res.headers.get("set-cookie") ?? "").toContain(SESSION_COOKIE);  });   it("rejects a replayed state (single-use contract preserved downstream)", async () => {    // Replay of a state whose cookie is gone (already consumed by the login    // round-trip) must fail closed.    const state = encodeLoginState({ nonce: "nonce-replay", returnTo: "/" });    const first = await run(      new Request(callbackUrl(state), {        headers: { cookie: `${STATE_COOKIE}=${state}` },        redirect: "manual",      }),    );    expect(first.status).toBe(302);     // Second callback: same state, no cookie (session-store consumed it).    const replay = await run(new Request(callbackUrl(state), { redirect: "manual" }));    expect(replay.status).toBe(400);  });}); describe("logout browser cleanup", () => {  it("clears browser storage when the browser presents an auth hint", async () => {    const response = await run(      new Request("https://executor.test/auth/logout", {        method: "POST",        headers: { cookie: "executor-auth-hint=1" },        redirect: "manual",      }),    );    expect(response.status).toBe(302);    expect(response.headers.get("clear-site-data")).toBe('"cache", "storage"');    expect(response.headers.get("set-cookie")).toContain("Max-Age=0");  });   it("does not clear storage for a request without same-site cookies", async () => {    const response = await run(      new Request("https://executor.test/auth/logout", {        method: "POST",        redirect: "manual",      }),    );    expect(response.status).toBe(302);    expect(response.headers.get("clear-site-data")).toBeNull();  });});