import { describe, expect, it } from "@effect/vitest";import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";import * as Option from "effect/Option";import {  AuthTemplateSlug,  ConnectionAddress,  ConnectionName,  IntegrationSlug,  OAuthClientSlug,  ProviderKey,  type Connection,  type OAuthClientSummary,} from "@executor-js/sdk/shared"; import {  missingScopes,  oauthReconnectPayload,  reconnectClientsView,  reconnectMode,  reconnectRoute,  reconnectStoredClient,  reconsentRequiredScopes,  retryReconnectClientsOnMenuOpen,} from "./oauth-reconnect"; const connection = (overrides: Partial<Connection> = {}): Connection => ({  owner: "user",  name: ConnectionName.make("personal-github"),  integration: IntegrationSlug.make("github"),  template: AuthTemplateSlug.make("oauth"),  provider: ProviderKey.make("default"),  address: ConnectionAddress.make("tools.github.user.personal-github"),  identityLabel: "Personal GitHub",  expiresAt: 123,  oauthClient: OAuthClientSlug.make("github-app"),  ...overrides,}); describe("reconnectMode (OAuth vs non-OAuth branch)", () => {  // The single field `oauthClient` decides the path: OAuth connections must  // re-consent (a refresh cannot widen scopes / fails with no refresh token).  it("returns 'oauth' when the connection carries an oauthClient slug", () => {    expect(reconnectMode(connection())).toBe("oauth");  });   it("returns 'refresh' when oauthClient is null (static credential)", () => {    expect(reconnectMode(connection({ oauthClient: null }))).toBe("refresh");  });   it("returns 'refresh' when oauthClient is absent", () => {    const { oauthClient: _drop, ...rest } = connection();    expect(reconnectMode(rest as Connection)).toBe("refresh");  });}); describe("oauthReconnectPayload (re-mint the SAME connection)", () => {  // The payload re-runs oauth.start with the SAME owner/integration/name so the  // backend mint upserts the existing row (widened union + fresh refresh token).  it("builds the start payload from an OAuth connection's own fields", () => {    const payload = oauthReconnectPayload(connection());    expect(payload).not.toBeNull();    expect(payload!.client).toBe(OAuthClientSlug.make("github-app"));    expect(payload!.owner).toBe("user");    expect(payload!.name).toBe(ConnectionName.make("personal-github"));    expect(payload!.integration).toBe(IntegrationSlug.make("github"));    expect(payload!.template).toBe(AuthTemplateSlug.make("oauth"));    expect(payload!.identityLabel).toBe("Personal GitHub");  });   it("maps a null identityLabel to undefined (optional payload field)", () => {    const payload = oauthReconnectPayload(connection({ identityLabel: null }));    expect(payload!.identityLabel).toBeUndefined();  });   it("returns null for a non-OAuth connection (no oauthClient)", () => {    expect(oauthReconnectPayload(connection({ oauthClient: null }))).toBeNull();  });}); const clientSummary = (overrides: Partial<OAuthClientSummary> = {}): OAuthClientSummary => ({  owner: "user",  slug: OAuthClientSlug.make("github-app"),  grant: "authorization_code",  authorizationUrl: "https://auth.example.com/authorize",  tokenUrl: "https://auth.example.com/token",  resource: null,  clientId: "client-123",  origin: { kind: "manual", integration: null },  ...overrides,}); describe("reconnectStoredClient (resolve a connection's stored app)", () => {  it("finds the stored row by slug and the app's stored owner", () => {    const stored = clientSummary();    expect(reconnectStoredClient([clientSummary({ owner: "org" }), stored], connection())).toBe(      stored,    );  });   it("matches against oauthClientOwner when the app is shared (org app, user connection)", () => {    const shared = clientSummary({ owner: "org" });    expect(reconnectStoredClient([shared], connection({ oauthClientOwner: "org" }))).toBe(shared);    // Without the stored app owner, the connection's own owner is the key.    expect(reconnectStoredClient([shared], connection())).toBeUndefined();  });   it("matches a first-party app on slug alone (config-declared, deployment-scoped)", () => {    const firstParty = clientSummary({      owner: "org",      slug: OAuthClientSlug.make("first-party:github"),      origin: { kind: "first_party" },    });    expect(      reconnectStoredClient(        [firstParty],        connection({ oauthClient: OAuthClientSlug.make("first-party:github") }),      ),    ).toBe(firstParty);  });   it("is undefined for a non-OAuth connection and for a binding whose row is gone", () => {    expect(      reconnectStoredClient([clientSummary()], connection({ oauthClient: null })),    ).toBeUndefined();    expect(reconnectStoredClient([], connection())).toBeUndefined();  });}); describe("reconnectRoute (where an OAuth Reconnect goes)", () => {  const dcrBinding = clientSummary({    origin: { kind: "dynamic_client_registration", integration: null },  });   // The summaries have not loaded → the stored binding is UNKNOWN, and no  // route may be chosen. The old routing chose "direct" here, permanently  // dead-ending an origin-drifted DCR client exactly as #1542 described.  it("waits (never chooses direct) while the client summaries are loading", () => {    expect(reconnectRoute(undefined, connection(), true)).toEqual({ kind: "unknown" });    expect(reconnectRoute(undefined, connection(), false)).toEqual({ kind: "unknown" });  });   // The BINDING's origin routes, not the method's capability flags: the  // automatic flow can probe the token URL even when the method declares no  // discovery/DCR support.  it("routes a DCR-origin binding to the automatic path regardless of method capability", () => {    expect(reconnectRoute([dcrBinding], connection(), false)).toEqual({      kind: "automatic",      stored: dcrBinding,    });    expect(reconnectRoute([dcrBinding], connection(), true)).toEqual({      kind: "automatic",      stored: dcrBinding,    });  });   // A manual (static/BYO) or first-party binding must keep the direct  // stored-client path — re-registering would silently rebind the connection.  it("keeps a manual (static/BYO) binding on the direct path even on a capable method", () => {    expect(reconnectRoute([clientSummary()], connection(), true)).toEqual({ kind: "direct" });  });   it("keeps a first-party binding on the direct path", () => {    expect(      reconnectRoute([clientSummary({ origin: { kind: "first_party" } })], connection(), true),    ).toEqual({ kind: "direct" });  });   // A binding whose row is GONE has nothing to start directly against, so  // re-registration is its only recovery — when the method supports the  // automatic flow at all.  it("re-registers a gone binding when the method supports the automatic flow", () => {    expect(reconnectRoute([], connection(), true)).toEqual({      kind: "automatic",      stored: undefined,    });    expect(reconnectRoute([], connection(), false)).toEqual({ kind: "direct" });  });}); describe("reconnectClientsView (Reconnect availability from the summaries query)", () => {  const dcrBinding = clientSummary({    origin: { kind: "dynamic_client_registration", integration: null },  });  const loaded = AsyncResult.success<readonly OAuthClientSummary[], string>([dcrBinding]);   it("is ready with the loaded summaries on success", () => {    expect(reconnectClientsView(loaded)).toEqual({ kind: "ready", clients: [dcrBinding] });  });   // Stale data NEVER routes: a binding changed since the retained snapshot can  // misroute (repeat the origin-drift dead end, or treat a client absent from  // the snapshot as vanished and rebind it). A failed refresh is failed even  // with previousSuccess — disabled, surfaced, and retried on menu open like  // any other failure.  it("is failed when a refresh fails, even with previous successful data", () => {    const failedRefresh = AsyncResult.fail("listClients failed", {      previousSuccess: Option.some(loaded),    });    const view = reconnectClientsView(failedRefresh);    expect(view).toEqual({ kind: "failed" });    // The failed view recovers like any other: opening the menu retries.    let calls = 0;    retryReconnectClientsOnMenuOpen(true, view, () => calls++);    expect(calls).toBe(1);  });   it("is loading while the first load is in flight", () => {    expect(reconnectClientsView(AsyncResult.initial())).toEqual({ kind: "loading" });    expect(reconnectClientsView(AsyncResult.initial(true))).toEqual({ kind: "loading" });  });   it("is failed for a first-load failure (never produced data)", () => {    expect(reconnectClientsView(AsyncResult.fail("listClients failed"))).toEqual({      kind: "failed",    });  });   it("reads a failure that is retrying as loading, not failed", () => {    expect(reconnectClientsView(AsyncResult.fail("listClients failed", { waiting: true }))).toEqual(      { kind: "loading" },    );    // A retry in flight is loading even when previous data is retained.    expect(      reconnectClientsView(        AsyncResult.fail("listClients failed", {          waiting: true,          previousSuccess: Option.some(loaded),        }),      ),    ).toEqual({ kind: "loading" });  });}); describe("retryReconnectClientsOnMenuOpen (recovery for a failed summaries query)", () => {  const counter = () => {    let calls = 0;    return { retry: () => calls++, calls: () => calls };  };   it("refetches when the menu OPENS on a failed view", () => {    const spy = counter();    retryReconnectClientsOnMenuOpen(true, { kind: "failed" }, spy.retry);    expect(spy.calls()).toBe(1);  });   it("does not refetch on close, while loading, or with data", () => {    const spy = counter();    retryReconnectClientsOnMenuOpen(false, { kind: "failed" }, spy.retry);    retryReconnectClientsOnMenuOpen(true, { kind: "loading" }, spy.retry);    retryReconnectClientsOnMenuOpen(true, { kind: "ready", clients: [] }, spy.retry);    expect(spy.calls()).toBe(0);  });}); describe("missingScopes (Part 2 informational subset warning)", () => {  // The app's scopes are a STRICT subset of the integration's → list what's  // missing, in the integration's declared order.  it("lists scopes the integration declares that the app does not grant", () => {    expect(missingScopes(["a", "b", "c"], ["a"])).toEqual(["b", "c"]);  });   it("is empty when the app covers everything the integration declares", () => {    expect(missingScopes(["a", "b"], ["a", "b"])).toEqual([]);  });   it("is empty when the app is a SUPERSET of the integration's scopes", () => {    expect(missingScopes(["a"], ["a", "b", "c"])).toEqual([]);  });   it("is empty when the integration declares no scopes", () => {    expect(missingScopes(undefined, ["a"])).toEqual([]);    expect(missingScopes([], ["a"])).toEqual([]);  });   it("treats undefined/empty client scopes as granting nothing", () => {    expect(missingScopes(["a", "b"], undefined)).toEqual(["a", "b"]);    expect(missingScopes(["a", "b"], [])).toEqual(["a", "b"]);  });   it("normalizes whitespace and dedupes before comparing (sets, not lists)", () => {    expect(missingScopes([" a ", "a", "b", ""], ["a"])).toEqual(["b"]);    expect(missingScopes(["a", "b"], [" a ", "a", ""])).toEqual(["b"]);  });   it("treats Google's expanded userinfo scopes as OIDC profile/email grants", () => {    expect(      missingScopes(        ["profile", "email", "https://www.googleapis.com/auth/calendar"],        [          "https://www.googleapis.com/auth/userinfo.profile",          "https://www.googleapis.com/auth/userinfo.email",          "https://www.googleapis.com/auth/calendar",          "openid",        ],      ),    ).toEqual([]);  });}); describe("reconsentRequiredScopes", () => {  it("treats spec-derived oauth scopes as NOT required (opportunistic catalog)", () => {    // An OpenAPI integration (e.g. PostHog) declares the full per-operation scope    // catalog. A narrower grant is healthy and must not nag for reconnect.    expect(      reconsentRequiredScopes({        source: "spec",        oauth: { scopes: ["insight:read", "insight:write", "person:read"] },      }),    ).toBeUndefined();  });   it("keeps custom (user-configured) oauth scopes required", () => {    expect(      reconsentRequiredScopes({        source: "custom",        oauth: { scopes: ["read", "write"] },      }),    ).toEqual(["read", "write"]);  });   it("returns undefined when there is no oauth method", () => {    expect(reconsentRequiredScopes(undefined)).toBeUndefined();  });});