// Cloud-only: the connection (credential) lifecycle over the real wire. In v2 a// connection IS the credential — owner-scoped, bound 1:1 to an integration,// identified by (owner, integration, name), with its value stored through the// real vault. The product promises under test: the secret goes in but NEVER// comes back out of any endpoint; metadata round-trips; re-creating the same// connection is rejected as a conflict instead of silently replacing it;// removal really removes; and unknown connections fail with a typed// not-found error.import { randomBytes } from "node:crypto";import { createServer } from "node:http"; import { expect } from "@effect/vitest";import { Effect } from "effect";import type { HttpApiClient } from "effect/unstable/httpapi";import { composePluginApi } from "@executor-js/api/server";import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";import { AuthTemplateSlug, ConnectionName, IntegrationSlug } from "@executor-js/sdk/shared"; import { scenario } from "../src/scenario";import { Api, Target } from "../src/services"; const api = composePluginApi([openApiHttpPlugin()] as const);type Client = HttpApiClient.ForApi<typeof api>; const TEMPLATE_API_KEY = AuthTemplateSlug.make("apiKey"); /** Minimal OpenAPI spec with a single GET /ping — only the conflict scenario * ever contacts it, to prove which stored secret the connection resolves. */const pingSpec = JSON.stringify({ openapi: "3.0.3", info: { title: "Ping API", version: "1.0.0" }, paths: { "/ping": { get: { operationId: "ping", summary: "Ping", responses: { "200": { description: "pong" } } }, }, },}); type CaptureUpstream = { readonly url: string; /** Every Authorization header `GET /ping` has received, in order. */ readonly authorizationHeaders: () => readonly string[]; readonly close: () => void;}; /** Upstream on 127.0.0.1 that records the Authorization header of every * `GET /ping`. This is how a scenario proves WHICH stored secret a connection * resolves, since no endpoint ever echoes the value itself. */const serveCaptureUpstream = () => Effect.acquireRelease( Effect.callback<CaptureUpstream>((resume) => { const headers: string[] = []; const server = createServer((request, response) => { if (request.method === "GET" && (request.url ?? "").startsWith("/ping")) { headers.push(request.headers.authorization ?? ""); response.writeHead(200, { "content-type": "application/json" }); response.end(JSON.stringify({ pong: true })); return; } response.writeHead(404, { "content-type": "application/json" }); response.end(JSON.stringify({ error: "not_found" })); }); server.listen(0, "127.0.0.1", () => { const address = server.address(); const port = typeof address === "object" && address ? address.port : 0; resume( Effect.succeed({ url: `http://127.0.0.1:${port}`, authorizationHeaders: () => [...headers], close: () => { server.close(); server.closeAllConnections(); }, }), ); }); }), (upstream) => Effect.sync(upstream.close), ); /** Registers a fresh apiKey-authenticated integration for connections to bind * to. Identifier-safe slug: it becomes a property path in sandbox code. */const registerIntegration = (client: Client, baseUrl = "http://127.0.0.1:59999") => Effect.gen(function* () { const slug = IntegrationSlug.make(`connscn${randomBytes(4).toString("hex")}`); yield* client.openapi.addSpec({ payload: { spec: { kind: "blob", value: pingSpec }, slug, baseUrl, // the default is never contacted during registration authenticationTemplate: [ { slug: "apiKey", type: "apiKey", headers: { authorization: ["Bearer ", { type: "variable", name: "token" }] }, }, ], }, }); return slug; }); // Already in canonical identifier form, so the name round-trips unchanged.const freshConnectionName = () => ConnectionName.make(`conn${randomBytes(4).toString("hex")}`); scenario( "Connections · a stored credential round-trips as metadata and never echoes its value", {}, Effect.gen(function* () { const target = yield* Target; const { client: apiClient } = yield* Api; const identity = yield* target.newIdentity(); const client = yield* apiClient(api, identity); const integration = yield* registerIntegration(client); const name = freshConnectionName(); const secretValue = `sk-test-${randomBytes(8).toString("hex")}`; const created = yield* client.connections.create({ payload: { owner: "org", name, integration, template: TEMPLATE_API_KEY, identityLabel: "My API Token", value: secretValue, }, }); expect(created.name, "create returns the stored connection name").toBe(name); expect(created.owner, "the connection is filed under its owner").toBe("org"); expect(JSON.stringify(created), "the create response never carries the secret").not.toContain( secretValue, ); const list = yield* client.connections.list({ query: { integration } }); const listed = list.find((connection) => connection.name === name); expect(listed?.identityLabel, "the listed connection keeps its label").toBe("My API Token"); expect(JSON.stringify(list), "the list never carries the secret").not.toContain(secretValue); const fetched = yield* client.connections.get({ params: { owner: "org", integration, name }, }); expect(fetched.name, "get returns the connection by its identifier").toBe(name); expect(fetched.integration, "get returns the connection bound to its integration").toBe( integration, ); expect(JSON.stringify(fetched), "get never carries the secret").not.toContain(secretValue); }),); scenario( "Connections · re-creating the same connection is rejected and leaves the original intact", {}, Effect.scoped( Effect.gen(function* () { const target = yield* Target; const { client: apiClient } = yield* Api; const identity = yield* target.newIdentity(); const client = yield* apiClient(api, identity); const upstream = yield* serveCaptureUpstream(); const integration = yield* registerIntegration(client, upstream.url); const name = freshConnectionName(); yield* client.connections.create({ payload: { owner: "org", name, integration, template: TEMPLATE_API_KEY, identityLabel: "first key", value: "first-value", }, }); const first = yield* client.connections.list({ query: { integration } }); expect( first.filter((connection) => connection.name === name).map((c) => c.identityLabel), "the first create stores one row with its label", ).toEqual(["first key"]); const error = yield* client.connections .create({ payload: { owner: "org", name, integration, template: TEMPLATE_API_KEY, identityLabel: "clobber attempt", value: "second-value", }, }) .pipe(Effect.flip); expect( (error as { _tag?: string })._tag, "re-creating the same (owner, integration, name) fails with the typed conflict", ).toBe("ConnectionAlreadyExistsError"); const second = yield* client.connections.list({ query: { integration } }); expect( second.filter((connection) => connection.name === name).map((c) => c.identityLabel), "the rejected create left the original row untouched", ).toEqual(["first key"]); // The stored SECRET is intact too, not just the metadata: invoking // through the original connection must still authenticate upstream with // the first value. The pasted value's provider item id is derived from // the connection name, so a rejected create that wrote before losing // would have replaced the credential while every metadata read above // still looked untouched. const tools = yield* client.tools.list({ query: { integration } }); const address = tools .map((tool) => String(tool.address)) .find((toolAddress) => toolAddress.includes(".ping.")); expect(address, "the ping tool is in the catalog").toBeDefined(); if (address === undefined) return; const execution = yield* client.executions.execute({ payload: { code: [`const result = await ${address}({});`, "return result;"].join("\n"), }, }); expect(execution.status, "the invoke completes").toBe("completed"); expect( upstream.authorizationHeaders(), "the original connection still authenticates with the first value", ).toEqual(["Bearer first-value"]); }), ),); scenario( "Connections · a removed connection disappears from both list and get", {}, Effect.gen(function* () { const target = yield* Target; const { client: apiClient } = yield* Api; const identity = yield* target.newIdentity(); const client = yield* apiClient(api, identity); const integration = yield* registerIntegration(client); const name = freshConnectionName(); yield* client.connections.create({ payload: { owner: "org", name, integration, template: TEMPLATE_API_KEY, value: "v" }, }); const removed = yield* client.connections.remove({ params: { owner: "org", integration, name }, }); expect(removed.removed, "remove acknowledges the deletion").toBe(true); const list = yield* client.connections.list({ query: { integration } }); expect( list.map((connection) => connection.name), "the removed connection is gone from the list", ).not.toContain(name); const error = yield* client.connections .get({ params: { owner: "org", integration, name } }) .pipe(Effect.flip); expect( (error as { _tag?: string })._tag, "get after remove fails with the typed not-found error", ).toBe("ConnectionNotFoundError"); }),); scenario( "Connections · reading or removing an unknown connection fails with not-found", {}, Effect.gen(function* () { const target = yield* Target; const { client: apiClient } = yield* Api; const identity = yield* target.newIdentity(); const client = yield* apiClient(api, identity); const integration = yield* registerIntegration(client); const missing = freshConnectionName(); const getError = yield* client.connections .get({ params: { owner: "org", integration, name: missing } }) .pipe(Effect.flip); expect( (getError as { _tag?: string })._tag, "get on an unknown connection fails with the typed not-found error", ).toBe("ConnectionNotFoundError"); const removeError = yield* client.connections .remove({ params: { owner: "org", integration, name: missing } }) .pipe(Effect.flip); expect( (removeError as { _tag?: string })._tag, "remove on an unknown connection fails with the typed not-found error", ).toBe("ConnectionNotFoundError"); }),);
// Cloud-only: the connection (credential) lifecycle over the real wire. In v2 a
// connection IS the credential — owner-scoped, bound 1:1 to an integration,
// identified by (owner, integration, name), with its value stored through the
// real vault. The product promises under test: the secret goes in but NEVER
// comes back out of any endpoint; metadata round-trips; re-creating the same
// connection is rejected as a conflict instead of silently replacing it;
// removal really removes; and unknown connections fail with a typed
// not-found error.
import { randomBytes } from "node:crypto";
import { createServer } from "node:http";
import { expect } from "@effect/vitest";
import { Effect } from "effect";
import type { HttpApiClient } from "effect/unstable/httpapi";
import { composePluginApi } from "@executor-js/api/server";
import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
import { AuthTemplateSlug, ConnectionName, IntegrationSlug } from "@executor-js/sdk/shared";
import { scenario } from "../src/scenario";
import { Api, Target } from "../src/services";
const api = composePluginApi([openApiHttpPlugin()] as const);
type Client = HttpApiClient.ForApi<typeof api>;
const TEMPLATE_API_KEY = AuthTemplateSlug.make("apiKey");
/** Minimal OpenAPI spec with a single GET /ping — only the conflict scenario
* ever contacts it, to prove which stored secret the connection resolves. */
const pingSpec = JSON.stringify({
openapi: "3.0.3",
info: { title: "Ping API", version: "1.0.0" },
paths: {
"/ping": {
get: { operationId: "ping", summary: "Ping", responses: { "200": { description: "pong" } } },
},
},
});
type CaptureUpstream = {
readonly url: string;
/** Every Authorization header `GET /ping` has received, in order. */
readonly authorizationHeaders: () => readonly string[];
readonly close: () => void;
};
/** Upstream on 127.0.0.1 that records the Authorization header of every
* `GET /ping`. This is how a scenario proves WHICH stored secret a connection
* resolves, since no endpoint ever echoes the value itself. */
const serveCaptureUpstream = () =>
Effect.acquireRelease(
Effect.callback<CaptureUpstream>((resume) => {
const headers: string[] = [];
const server = createServer((request, response) => {
if (request.method === "GET" && (request.url ?? "").startsWith("/ping")) {
headers.push(request.headers.authorization ?? "");
response.writeHead(200, { "content-type": "application/json" });
response.end(JSON.stringify({ pong: true }));
return;
}
response.writeHead(404, { "content-type": "application/json" });
response.end(JSON.stringify({ error: "not_found" }));
});
server.listen(0, "127.0.0.1", () => {
const address = server.address();
const port = typeof address === "object" && address ? address.port : 0;
resume(
Effect.succeed({
url: `http://127.0.0.1:${port}`,
authorizationHeaders: () => [...headers],
close: () => {
server.close();
server.closeAllConnections();
},
}),
);
});
}),
(upstream) => Effect.sync(upstream.close),
);
/** Registers a fresh apiKey-authenticated integration for connections to bind
* to. Identifier-safe slug: it becomes a property path in sandbox code. */
const registerIntegration = (client: Client, baseUrl = "http://127.0.0.1:59999") =>
Effect.gen(function* () {
const slug = IntegrationSlug.make(`connscn${randomBytes(4).toString("hex")}`);
yield* client.openapi.addSpec({
payload: {
spec: { kind: "blob", value: pingSpec },
slug,
baseUrl, // the default is never contacted during registration
authenticationTemplate: [
{
slug: "apiKey",
type: "apiKey",
headers: { authorization: ["Bearer ", { type: "variable", name: "token" }] },
},
],
},
});
return slug;
});
// Already in canonical identifier form, so the name round-trips unchanged.
const freshConnectionName = () => ConnectionName.make(`conn${randomBytes(4).toString("hex")}`);
scenario(
"Connections · a stored credential round-trips as metadata and never echoes its value",
{},
Effect.gen(function* () {
const target = yield* Target;
const { client: apiClient } = yield* Api;
const identity = yield* target.newIdentity();
const client = yield* apiClient(api, identity);
const integration = yield* registerIntegration(client);
const name = freshConnectionName();
const secretValue = `sk-test-${randomBytes(8).toString("hex")}`;
const created = yield* client.connections.create({
payload: {
owner: "org",
name,
integration,
template: TEMPLATE_API_KEY,
identityLabel: "My API Token",
value: secretValue,
},
});
expect(created.name, "create returns the stored connection name").toBe(name);
expect(created.owner, "the connection is filed under its owner").toBe("org");
expect(JSON.stringify(created), "the create response never carries the secret").not.toContain(
secretValue,
);
const list = yield* client.connections.list({ query: { integration } });
const listed = list.find((connection) => connection.name === name);
expect(listed?.identityLabel, "the listed connection keeps its label").toBe("My API Token");
expect(JSON.stringify(list), "the list never carries the secret").not.toContain(secretValue);
const fetched = yield* client.connections.get({
params: { owner: "org", integration, name },
});
expect(fetched.name, "get returns the connection by its identifier").toBe(name);
expect(fetched.integration, "get returns the connection bound to its integration").toBe(
integration,
);
expect(JSON.stringify(fetched), "get never carries the secret").not.toContain(secretValue);
}),
);
scenario(
"Connections · re-creating the same connection is rejected and leaves the original intact",
{},
Effect.scoped(
Effect.gen(function* () {
const target = yield* Target;
const { client: apiClient } = yield* Api;
const identity = yield* target.newIdentity();
const client = yield* apiClient(api, identity);
const upstream = yield* serveCaptureUpstream();
const integration = yield* registerIntegration(client, upstream.url);
const name = freshConnectionName();
yield* client.connections.create({
payload: {
owner: "org",
name,
integration,
template: TEMPLATE_API_KEY,
identityLabel: "first key",
value: "first-value",
},
});
const first = yield* client.connections.list({ query: { integration } });
expect(
first.filter((connection) => connection.name === name).map((c) => c.identityLabel),
"the first create stores one row with its label",
).toEqual(["first key"]);
const error = yield* client.connections
.create({
payload: {
owner: "org",
name,
integration,
template: TEMPLATE_API_KEY,
identityLabel: "clobber attempt",
value: "second-value",
},
})
.pipe(Effect.flip);
expect(
(error as { _tag?: string })._tag,
"re-creating the same (owner, integration, name) fails with the typed conflict",
).toBe("ConnectionAlreadyExistsError");
const second = yield* client.connections.list({ query: { integration } });
expect(
second.filter((connection) => connection.name === name).map((c) => c.identityLabel),
"the rejected create left the original row untouched",
).toEqual(["first key"]);
// The stored SECRET is intact too, not just the metadata: invoking
// through the original connection must still authenticate upstream with
// the first value. The pasted value's provider item id is derived from
// the connection name, so a rejected create that wrote before losing
// would have replaced the credential while every metadata read above
// still looked untouched.
const tools = yield* client.tools.list({ query: { integration } });
const address = tools
.map((tool) => String(tool.address))
.find((toolAddress) => toolAddress.includes(".ping."));
expect(address, "the ping tool is in the catalog").toBeDefined();
if (address === undefined) return;
const execution = yield* client.executions.execute({
payload: {
code: [`const result = await ${address}({});`, "return result;"].join("\n"),
},
});
expect(execution.status, "the invoke completes").toBe("completed");
expect(
upstream.authorizationHeaders(),
"the original connection still authenticates with the first value",
).toEqual(["Bearer first-value"]);
}),
),
);
scenario(
"Connections · a removed connection disappears from both list and get",
{},
Effect.gen(function* () {
const target = yield* Target;
const { client: apiClient } = yield* Api;
const identity = yield* target.newIdentity();
const client = yield* apiClient(api, identity);
const integration = yield* registerIntegration(client);
const name = freshConnectionName();
yield* client.connections.create({
payload: { owner: "org", name, integration, template: TEMPLATE_API_KEY, value: "v" },
});
const removed = yield* client.connections.remove({
params: { owner: "org", integration, name },
});
expect(removed.removed, "remove acknowledges the deletion").toBe(true);
const list = yield* client.connections.list({ query: { integration } });
expect(
list.map((connection) => connection.name),
"the removed connection is gone from the list",
).not.toContain(name);
const error = yield* client.connections
.get({ params: { owner: "org", integration, name } })
.pipe(Effect.flip);
expect(
(error as { _tag?: string })._tag,
"get after remove fails with the typed not-found error",
).toBe("ConnectionNotFoundError");
}),
);
scenario(
"Connections · reading or removing an unknown connection fails with not-found",
{},
Effect.gen(function* () {
const target = yield* Target;
const { client: apiClient } = yield* Api;
const identity = yield* target.newIdentity();
const client = yield* apiClient(api, identity);
const integration = yield* registerIntegration(client);
const missing = freshConnectionName();
const getError = yield* client.connections
.get({ params: { owner: "org", integration, name: missing } })
.pipe(Effect.flip);
expect(
(getError as { _tag?: string })._tag,
"get on an unknown connection fails with the typed not-found error",
).toBe("ConnectionNotFoundError");
const removeError = yield* client.connections
.remove({ params: { owner: "org", integration, name: missing } })
.pipe(Effect.flip);
expect(
(removeError as { _tag?: string })._tag,
"remove on an unknown connection fails with the typed not-found error",
).toBe("ConnectionNotFoundError");
}),
);