// Cloud-only: the connect deep link's REASON FOR CARRYING AN ORG SLUG.//// An operator on the admin Users page copies a connect link for a member who// hasn't connected something yet and sends it to them. `connectLinkUrl` builds// that link org-PREFIXED (`/<org>/connect/<slug>`) rather than bare, and the// failure that choice prevents is specific and silent: a recipient who belongs// to several workspaces has ONE session-default org, and a bare `/connect/x`// resolves against THAT one. They would land in the wrong workspace, connect a// real credential there, and nothing anywhere would report a problem — the// connection succeeds, it is just in the wrong tenant. The sender then keeps// seeing an unconnected user.//// The existing coverage cannot catch this. `scenarios/connect-deep-link.test.ts`// deliberately accepts EITHER URL form (it runs on hosts with and without an// org segment) and its user belongs to one org, so both forms resolve to the// same place. `packages/react/src/routes/connect-deep-link.test.ts` only proves// the router parses the param. Neither has a second org to land in by mistake.//// So: a recipient who is a member of TWO orgs, whose session defaults to org B,// follows an org-A-scoped link, and the credential must end up in org A.//// Both orgs register an integration under the SAME slug — that is what makes// this a real test. With distinct slugs, org B's catalog would simply not// contain the link's slug and the page would show its not-found state, so the// scenario would pass for the wrong reason (a lookup miss rather than correct// scoping). Sharing the slug means BOTH orgs can satisfy the link, and only the// org prefix decides which one does.import { randomBytes } from "node:crypto"; import { expect } from "@effect/vitest";import { Effect } from "effect";import type { HttpApiClient } from "effect/unstable/httpapi";import { composePluginApi } from "@executor-js/api/server";import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";import { IntegrationSlug } from "@executor-js/sdk/shared"; import { scenario } from "../src/scenario";import { Api, Browser, Target } from "../src/services";import { activeOrg, forBrowser, joinOrg, organizationsOf } from "./support/session"; const api = composePluginApi([openApiHttpPlugin()] as const);type Client = HttpApiClient.ForApi<typeof api>; /** The spec's title, which the console uses to name a saved connection *  ("Personal Ping API"). */const INTEGRATION_TITLE = "Ping API"; /** Minimal OpenAPI spec with a single GET /ping — never contacted here. */const pingSpec = JSON.stringify({  openapi: "3.0.3",  info: { title: INTEGRATION_TITLE, version: "1.0.0" },  paths: {    "/ping": {      get: { operationId: "ping", summary: "Ping", responses: { "200": { description: "pong" } } },    },  },}); /** Register an apiKey-authenticated integration under an EXACT slug, so both *  orgs can hold the same catalog identity. */const registerIntegration = (client: Client, slug: IntegrationSlug) =>  client.openapi.addSpec({    payload: {      spec: { kind: "blob", value: pingSpec },      slug,      baseUrl: "http://127.0.0.1:59999", // never contacted during registration      authenticationTemplate: [        {          slug: "apiKey",          type: "apiKey",          headers: { authorization: ["Bearer ", { type: "variable", name: "token" }] },        },      ],    },  }); scenario(  "Connect · an org-scoped connect link lands a multi-org recipient in the SENDING org",  { timeout: 180_000 },  Effect.gen(function* () {    const target = yield* Target;    const browser = yield* Browser;    const { client: apiClient } = yield* Api;     // Two workspaces with two different owners, and one person invited into    // both. Built through the real invite flow, so the memberships are the ones    // WorkOS actually issues.    const ownerA = yield* target.newIdentity();    const ownerB = yield* target.newIdentity();    const recipientSeed = yield* target.newIdentity({ org: false });     const joinedA = yield* joinOrg(target, ownerA, recipientSeed);    // Accepting B's invitation SECOND re-seals the session onto org B, which is    // exactly the hazard: the recipient's default is now the wrong workspace    // for the link they are about to follow.    const inOrgB = yield* joinOrg(target, ownerB, joinedA);     // `joinedA`'s cookie was re-sealed by the SECOND accept, so it is stale and    // must not be used to read anything — the recipient's live session is    // `inOrgB`, pointed at whichever org a given read is about.    const orgA = yield* activeOrg(target, ownerA);    const orgB = yield* activeOrg(target, inOrgB);    expect(orgA.id, "the two workspaces are genuinely different").not.toBe(orgB.id);     const memberships = yield* organizationsOf(target, inOrgB);    expect(      memberships.organizations.map((org) => org.id).sort(),      "the recipient really is a member of BOTH workspaces",    ).toEqual([orgA.id, orgB.id].sort());    expect(      memberships.activeOrganizationId,      "and their session defaults to org B — the org the link does NOT point at",    ).toBe(orgB.id);     const ownerAClient = yield* apiClient(api, ownerA);    const ownerBClient = yield* apiClient(api, ownerB);     // ONE slug, registered in BOTH catalogs (see the header note).    const slug = IntegrationSlug.make(`multiorg-${randomBytes(4).toString("hex")}`);     yield* Effect.ensuring(      Effect.gen(function* () {        yield* registerIntegration(ownerAClient, slug);        yield* registerIntegration(ownerBClient, slug);         // The link an operator copies off org A's Users page. Built here the        // same way the page builds it (origin + org prefix + slug); the page's        // own rendering of it is asserted in `admin-users-console.test.ts`.        const origin = new URL(target.baseUrl).origin;        const connectLink = `${origin}/${orgA.slug}/connect/${slug}`;         // The recipient follows the link with their org-B-default session.        yield* browser.session(forBrowser(inOrgB), async ({ page, step }) => {          await step("Follow the org-A connect link with an org-B session", async () => {            // `domcontentloaded`, not `networkidle`: the console holds live            // connections open, so idle is not a state this page reaches. The            // real wait is the redirect assertion below.            await page.goto(connectLink, { waitUntil: "domcontentloaded" });            // The deep link forwards into the integration detail route with the            // add-account handoff — and it must keep ORG A's prefix through the            // redirect. Landing on `/${orgB.slug}/...` here IS the bug.            await page.waitForURL((url) => url.pathname === `/${orgA.slug}/integrations/${slug}`, {              timeout: 30_000,            });            expect(              new URL(page.url()).pathname.split("/").filter(Boolean)[0],              "the connect flow stayed in the SENDING org, not the session default",            ).toBe(orgA.slug);            expect(new URL(page.url()).searchParams.get("addAccount")).toBe("1");          });           await step("Complete the connection from that page", async () => {            const dialog = page.getByRole("dialog");            await dialog.getByRole("heading", { name: /Add connection/ }).waitFor({              timeout: 30_000,            });            // The credential field is labelled by the method's PLACEMENT (the            // `authorization` header this spec declares), not by the variable.            // Waited for explicitly: the field renders only once the modal has            // loaded the integration's auth methods, which is a second fetch            // after the heading appears.            const credential = dialog.getByRole("textbox", { name: "authorization" });            await credential.waitFor({ state: "visible", timeout: 90_000 });            await credential.fill("recipient-personal-token");            // The offered health check is opt-in (it runs only on "Check"), and            // this spec's base URL is never served — so the credential is saved            // unprobed, which is what this scenario is about: WHERE it lands,            // not whether it works.            await dialog.getByRole("button", { name: "Continue" }).click();            await dialog.getByRole("button", { name: "Add connection" }).click();            // The saved credential appears as a row in the accounts list of the            // page it was saved from — and that page is ORG A's (its URL was            // pinned to `orgA.slug` in the step above). So this row IS the            // "landed in the sending workspace" half of the guarantee, read            // from the surface the recipient is actually looking at.            //            // Waited on rather than the success toast (which auto-dismisses            // below the fold) or the dialog's disappearance (which races the            // close animation).            await page              .getByText(`Personal ${INTEGRATION_TITLE}`, { exact: true })              .first()              .waitFor({ state: "visible", timeout: 90_000 });            expect(              new URL(page.url()).pathname.split("/").filter(Boolean)[0],              "the credential was saved from a page scoped to the SENDING org",            ).toBe(orgA.slug);          });           // ── The other half: it is NOT in the session's default org ─────────          //          // Same person, same session, same integration slug — the only thing          // that differs is the org in the URL. Org B registered the SAME slug,          // so this page exists and renders; it simply must hold no connection.          // Had the link resolved against the session default, THIS is the page          // the credential would be on.          await step("Org B — the session's own default — has none", async () => {            await page.goto(`${origin}/${orgB.slug}/integrations/${slug}?tab=accounts`, {              waitUntil: "domcontentloaded",            });            // Wait for the accounts panel to finish loading before asserting an            // absence, so "not rendered yet" cannot pass as "not there". The            // empty state is the positive signal that the list resolved AND is            // empty — checking only for the missing row would also pass while            // the list was still loading.            await page              .getByRole("button", { name: "Add connection" })              .first()              .waitFor({ state: "visible", timeout: 90_000 });            await page              .getByText("No connections", { exact: false })              .first()              .waitFor({ state: "visible", timeout: 90_000 });            expect(              await page.getByText(`Personal ${INTEGRATION_TITLE}`, { exact: true }).count(),              "nothing landed in the org the recipient's session happened to default to",            ).toBe(0);          });        });      }),      // Removing each org's spec takes its connections with it, so the      // UI-created credential (whose name the console chose) needs no lookup.      Effect.all(        [          ownerAClient.openapi.removeSpec({ params: { slug } }).pipe(Effect.ignore),          ownerBClient.openapi.removeSpec({ params: { slug } }).pipe(Effect.ignore),        ],        { discard: true },      ),    );  }),);