import { describe, expect, it } from "@effect/vitest"; import {  firstPartyOAuthClientsFor,  type FirstPartyOAuthClientEnv,} from "./first-party-oauth-clients"; const completeEnv: FirstPartyOAuthClientEnv = {  FIRST_PARTY_AIRTABLE_CLIENT_ID: "airtable-id",  FIRST_PARTY_AIRTABLE_CLIENT_SECRET: "airtable-secret",  FIRST_PARTY_ATLASSIAN_CLIENT_ID: "atlassian-id",  FIRST_PARTY_ATLASSIAN_CLIENT_SECRET: "atlassian-secret",  FIRST_PARTY_BOX_CLIENT_ID: "box-id",  FIRST_PARTY_BOX_CLIENT_SECRET: "box-secret",  FIRST_PARTY_CLICKUP_CLIENT_ID: "clickup-id",  FIRST_PARTY_CLICKUP_CLIENT_SECRET: "clickup-secret",  FIRST_PARTY_FIGMA_CLIENT_ID: "figma-id",  FIRST_PARTY_FIGMA_CLIENT_SECRET: "figma-secret",  FIRST_PARTY_GITHUB_CLIENT_ID: "github-id",  FIRST_PARTY_GITHUB_CLIENT_SECRET: "github-secret",  FIRST_PARTY_GITLAB_CLIENT_ID: "gitlab-id",  FIRST_PARTY_GITLAB_CLIENT_SECRET: "gitlab-secret",  FIRST_PARTY_GOOGLE_CLIENT_ID: "google-id",  FIRST_PARTY_GOOGLE_CLIENT_SECRET: "google-secret",  FIRST_PARTY_HUBSPOT_CLIENT_ID: "hubspot-id",  FIRST_PARTY_HUBSPOT_CLIENT_SECRET: "hubspot-secret",  FIRST_PARTY_LINEAR_CLIENT_ID: "linear-id",  FIRST_PARTY_LINEAR_CLIENT_SECRET: "linear-secret",  FIRST_PARTY_MICROSOFT_CLIENT_ID: "microsoft-id",  FIRST_PARTY_MICROSOFT_CLIENT_SECRET: "microsoft-secret",  FIRST_PARTY_NOTION_CLIENT_ID: "notion-id",  FIRST_PARTY_NOTION_CLIENT_SECRET: "notion-secret",  FIRST_PARTY_SLACK_CLIENT_ID: "slack-id",  FIRST_PARTY_SLACK_CLIENT_SECRET: "slack-secret",}; describe("cloud first-party OAuth clients", () => {  it("enables every registered OAuth 2 provider from complete secret pairs", () => {    const clients = firstPartyOAuthClientsFor(completeEnv);     expect(clients.map((client) => client.name)).toEqual([      "airtable",      "atlassian",      "box",      "clickup",      "figma",      "github",      "gitlab",      "google",      "hubspot",      "linear",      "microsoft",      "notion",      "slack",    ]);  });   it("fails closed when either half of a provider secret pair is absent", () => {    expect(firstPartyOAuthClientsFor({ FIRST_PARTY_AIRTABLE_CLIENT_ID: "id" })).toEqual([]);    expect(firstPartyOAuthClientsFor({ FIRST_PARTY_AIRTABLE_CLIENT_SECRET: "secret" })).toEqual([]);  });   it("carries provider-specific authorization and token contracts", () => {    const byName = new Map(      firstPartyOAuthClientsFor(completeEnv).map((client) => [client.name, client]),    );     expect(byName.get("airtable")).toMatchObject({      tokenEndpointAuthMethod: "basic",    });    expect(byName.get("atlassian")).toMatchObject({      tokenRequestFormat: "json",      authorizationExtraParams: { audience: "api.atlassian.com", prompt: "consent" },    });    expect(byName.get("figma")).toMatchObject({      tokenEndpointAuthMethod: "basic",      allowedScopes: expect.arrayContaining(["folder_metadata:read", "folders:read"]),    });    expect(byName.get("hubspot")).toMatchObject({      tokenUrl: "https://api.hubapi.com/oauth/v3/token",      authorizationExtraParams: {        optional_scope: "content crm.objects.custom.read crm.schemas.custom.read",      },    });    expect(byName.get("linear")).toMatchObject({ authorizationScopeSeparator: "," });    expect(byName.get("microsoft")).toMatchObject({      additionalAuthorizationScopes: ["offline_access"],      allowedScopes: expect.arrayContaining(["Mail.ReadWrite", "Files.ReadWrite.All"]),    });    expect(byName.get("notion")).toMatchObject({      authorizationScopes: [],      authorizationExtraParams: { owner: "user" },      tokenEndpointAuthMethod: "basic",      tokenRequestFormat: "json",    });  });}); // The reviewed consumer scope boundary of the Executor-owned Google app.//// These assertions used to live in `e2e/scenarios/first-party-oauth.test.ts`,// read off `listClients`. The app is now `unlisted`, so it has no read surface// to introspect — the bundle is only observable on the config it is built from,// which is here. The e2e still owns the BEHAVIOUR the boundary produces (which// scopes an `oauth.start` requests, and that admin scopes are refused).const GOOGLE_SCOPE = (suffix: string) => `https://www.googleapis.com/auth/${suffix}`; describe("cloud first-party Google app", () => {  const google = () =>    firstPartyOAuthClientsFor(completeEnv).find((client) => client.name === "google");   it("declares the Google app but withholds it from every listing", () => {    const client = google();    expect(client, "the env-declared first-party Google app is configured").toBeDefined();    // The entry MUST stay declared: `loadClient` resolves it by slug for every    // existing connection's refresh and reconnect. `unlisted` is what stops it    // being offered for new connections.    expect(client?.unlisted).toBe(true);  });   it("covers the reviewed consumer bundle", () => {    const allowed = google()?.allowedScopes;    expect(allowed).toBeDefined();    for (const scope of [      "calendar",      "meetings.space.readonly",      "spreadsheets",      "drive.file",      "drive",      "documents",      "presentations",      "forms.body",      "forms.responses.readonly",      "tasks",      "contacts",      "contacts.other.readonly",      "directory.readonly",      "user.addresses.read",      "user.birthday.read",      "user.emails.read",      "user.gender.read",      "user.organization.read",      "user.phonenumbers.read",      "photoslibrary.appendonly",      "photoslibrary.edit.appcreateddata",      "photospicker.mediaitems.readonly",      "webmasters",      "gmail.settings.basic",    ]) {      expect(allowed).toContain(GOOGLE_SCOPE(scope));    }    // `gmail.modify` stays in the host-enforced allowlist on purpose: a    // connection created before the full-Gmail review still declares it, and    // `resolveFirstPartyScopes` filters discovered scopes through this list, so    // dropping it would break those reconnects — as the legacy-spec case in the    // e2e asserts. The invariant that new Gmail presets request    // `mail.google.com` instead lives in the preset unit tests    // (packages/plugins/openapi/.../presets.test.ts), which is where the    // request-side scope choice is actually decided.    expect(allowed).toContain("https://mail.google.com/");    expect(allowed).toContain(GOOGLE_SCOPE("gmail.modify"));  });   it("excludes the scopes held back from consumer review", () => {    const allowed = google()?.allowedScopes;    expect(allowed).toBeDefined();    for (const scope of [      "gmail.settings.sharing",      "admin.directory.user",      "youtube",      "cloud-platform",    ]) {      expect(allowed).not.toContain(GOOGLE_SCOPE(scope));    }  });});