// ---------------------------------------------------------------------------// MCP multi-placement auth (wire-level)//// The extreme case the unified model exists for: ONE auth method that mixes a// bearer HEADER and a team-id QUERY PARAM, each rendered from its own// credential input — plus the single-placement query case (servers like ui.sh// authenticate via `?token=`), and the explicit failure when an input is// missing. Methods are authored request-shaped (the one input dialect); assertions are// made against what the server actually RECEIVED.// --------------------------------------------------------------------------- import { describe, expect, it } from "@effect/vitest";import { Effect } from "effect"; import {  AuthTemplateSlug,  ConnectionName,  IntegrationSlug,  ToolAddress,  createExecutor,} from "@executor-js/sdk";import { makeTestConfig, memoryCredentialsPlugin } from "@executor-js/sdk/testing"; import { mcpPlugin } from "./plugin";import { variable } from "@executor-js/sdk/http-auth";import { makeEchoMcpServer, serveMcpServer } from "../testing"; const serveRecordingServer = serveMcpServer(() =>  makeEchoMcpServer({    name: "multi-auth-test",    toolName: "whoami",    toolDescription: "Echoes a marker so the test can prove the invoke reached the server",    inputName: "marker",    text: (marker) => `ok:${marker}`,  }),); describe("MCP multi-placement auth", () => {  it.effect("one method renders a bearer header AND a team-id query param", () =>    Effect.gen(function* () {      const server = yield* serveRecordingServer;      const executor = yield* createExecutor(        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),      );       yield* executor.mcp.addServer({        name: "Mixed MCP",        endpoint: server.url,        slug: "mixed_mcp",        authenticationTemplate: [          {            slug: "token_and_team",            type: "apiKey",            headers: { Authorization: ["Bearer ", variable("api_token")] },            queryParams: { team_id: [variable("team_id")] },          },        ],      });       yield* executor.connections.create({        owner: "org",        name: ConnectionName.make("main"),        integration: IntegrationSlug.make("mixed_mcp"),        template: AuthTemplateSlug.make("token_and_team"),        values: { api_token: "tok_A", team_id: "team_B" },      });       const before = (yield* server.requests).length;      const result = yield* executor.execute(        ToolAddress.make("tools.mixed_mcp.org.main.whoami"),        { marker: "mixed" },        { onElicitation: "accept-all" },      );      expect(result).toMatchObject({        ok: true,        data: { content: [{ type: "text", text: "ok:mixed" }] },      });       const requests = (yield* server.requests).slice(before);      expect(requests.length).toBeGreaterThan(0);      // BOTH carriers rendered, each from its own credential input.      expect(requests.every((request) => request.authorization === "Bearer tok_A")).toBe(true);      expect(requests.every((request) => request.url.includes("team_id=team_B"))).toBe(true);    }),  );   it.effect("a query-only method renders ?token= and no Authorization header (ui.sh)", () =>    Effect.gen(function* () {      const server = yield* serveRecordingServer;      const executor = yield* createExecutor(        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),      );       yield* executor.mcp.addServer({        name: "Query MCP",        endpoint: server.url,        slug: "query_mcp",        authenticationTemplate: [{ type: "apiKey", queryParams: { token: [variable("token")] } }],      });       // Slug-less single-query-placement methods get the `query` slug.      yield* executor.connections.create({        owner: "org",        name: ConnectionName.make("main"),        integration: IntegrationSlug.make("query_mcp"),        template: AuthTemplateSlug.make("query"),        value: "tok_secret_123",      });       const before = (yield* server.requests).length;      const result = yield* executor.execute(        ToolAddress.make("tools.query_mcp.org.main.whoami"),        { marker: "qconn" },        { onElicitation: "accept-all" },      );      expect(result).toMatchObject({ ok: true });       const requests = (yield* server.requests).slice(before);      expect(requests.length).toBeGreaterThan(0);      expect(requests.every((request) => request.url.includes("token=tok_secret_123"))).toBe(true);      expect(requests.every((request) => request.authorization === undefined)).toBe(true);    }),  );   it.effect("a connection binding one method does not leak into another method's shape", () =>    Effect.gen(function* () {      const server = yield* serveRecordingServer;      const executor = yield* createExecutor(        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),      );       // Two declared methods; each connection picks one by template slug.      yield* executor.mcp.addServer({        name: "Multi MCP",        endpoint: server.url,        slug: "multi_mcp",        authenticationTemplate: [          {            slug: "bearer",            type: "apiKey",            headers: { Authorization: ["Bearer ", variable("token")] },          },          {            slug: "query_token",            type: "apiKey",            queryParams: { auth_token: [variable("token")] },          },        ],      });       yield* executor.connections.create({        owner: "org",        name: ConnectionName.make("hconn"),        integration: IntegrationSlug.make("multi_mcp"),        template: AuthTemplateSlug.make("bearer"),        value: "header-secret",      });      yield* executor.connections.create({        owner: "org",        name: ConnectionName.make("qconn"),        integration: IntegrationSlug.make("multi_mcp"),        template: AuthTemplateSlug.make("query_token"),        value: "query-secret",      });       const beforeHeader = (yield* server.requests).length;      yield* executor.execute(        ToolAddress.make("tools.multi_mcp.org.hconn.whoami"),        { marker: "h" },        { onElicitation: "accept-all" },      );      const headerRequests = (yield* server.requests)        .slice(beforeHeader)        .filter((request) => request.method === "POST");      expect(headerRequests.every((r) => r.authorization === "Bearer header-secret")).toBe(true);      expect(headerRequests.every((r) => !r.url.includes("auth_token="))).toBe(true);       const beforeQuery = (yield* server.requests).length;      yield* executor.execute(        ToolAddress.make("tools.multi_mcp.org.qconn.whoami"),        { marker: "q" },        { onElicitation: "accept-all" },      );      const queryRequests = (yield* server.requests)        .slice(beforeQuery)        .filter((request) => request.method === "POST");      expect(queryRequests.every((r) => r.url.includes("auth_token=query-secret"))).toBe(true);      expect(queryRequests.every((r) => r.authorization === undefined)).toBe(true);    }),  );   it.effect("invoking with a missing credential input fails explicitly, not silently", () =>    Effect.gen(function* () {      const server = yield* serveRecordingServer;      const executor = yield* createExecutor(        makeTestConfig({ plugins: [memoryCredentialsPlugin(), mcpPlugin()] as const }),      );       yield* executor.mcp.addServer({        name: "Strict MCP",        endpoint: server.url,        slug: "strict_mcp",        authenticationTemplate: [          {            slug: "two_inputs",            type: "apiKey",            headers: { Authorization: ["Bearer ", variable("a")] },            queryParams: { team_id: [variable("b")] },          },        ],      });       // Only one of the two inputs is supplied.      yield* executor.connections.create({        owner: "org",        name: ConnectionName.make("half"),        integration: IntegrationSlug.make("strict_mcp"),        template: AuthTemplateSlug.make("two_inputs"),        values: { a: "tok_A" },      });       const result = (yield* executor.execute(        ToolAddress.make("tools.strict_mcp.org.half.whoami"),        { marker: "x" },        { onElicitation: "accept-all" },      )) as { ok: boolean; error?: { code?: string; message?: string } };      expect(result.ok).toBe(false);      expect(result.error).toMatchObject({ code: "connection_value_missing" });      expect(String(result.error?.message ?? "")).toContain("b");    }),  );});