import { describe, expect, it } from "@effect/vitest"; import { browserTracesResponse } from "./browser-traces"; const makeRequest = (init?: RequestInit & { path?: string }) =>  new Request(`https://executor.sh${init?.path ?? "/v1/traces"}`, {    method: "POST",    body: "{}",    ...init,  }); const baseEnv = {  AXIOM_TOKEN: "axiom-secret",  AXIOM_DATASET: "executor-cloud",} as Env; describe("browserTracesResponse", () => {  it("ignores non-/v1/traces requests entirely", () => {    expect(browserTracesResponse(makeRequest({ path: "/api/tools" }), baseEnv)).toBeNull();  });   it("drops batches silently when Axiom is not configured", async () => {    const response = await browserTracesResponse(      makeRequest({ headers: { cookie: "wos-session=abc" } }),      {} as Env,    );    expect(response?.status).toBe(204);  });   it("rejects anonymous posts", async () => {    const response = await browserTracesResponse(makeRequest(), baseEnv);    expect(response?.status).toBe(401);  });   it("forwards to Axiom with server-held credentials and hides the upstream body", async () => {    let seen: { url: string; auth: string | null; dataset: string | null } | undefined;    const response = await browserTracesResponse(      makeRequest({ headers: { cookie: "wos-session=abc" } }),      baseEnv,      (async (url: RequestInfo | URL, init?: RequestInit) => {        seen = {          url: String(url),          auth: new Headers(init?.headers).get("authorization"),          dataset: new Headers(init?.headers).get("x-axiom-dataset"),        };        return new Response("axiom-internals", { status: 200 });      }) as typeof fetch,    );    expect(seen?.url).toBe("https://api.axiom.co/v1/traces");    expect(seen?.auth).toBe("Bearer axiom-secret");    expect(seen?.dataset).toBe("executor-cloud");    expect(response?.status).toBe(204);    expect(await response?.text()).toBe("");  });   it("scrubs credential-bearing URLs from the forwarded payload", async () => {    // The browser's OTLP batch is pre-serialized JSON; the worker must scrub    // the decoded payload before forwarding — the page-side exporter is not a    // trust boundary.    const SECRET = "synthetic-browser-forward-canary";    const payload = {      resourceSpans: [        {          resource: { attributes: [] },          scopeSpans: [            {              scope: { name: "executor-web" },              spans: [                {                  traceId: "0af7651916cd43dd8448eb211c80319c",                  spanId: "b7ad6b7169203331",                  name: "http.client GET",                  kind: 3,                  startTimeUnixNano: "0",                  endTimeUnixNano: "1",                  attributes: [                    {                      key: "url.full",                      value: {                        stringValue: `https://app.test/api/oauth/callback?code=${SECRET}-code#access_token=${SECRET}-fragment`,                        // Crafted sibling fields: the page-side exporter is not                        // a trust boundary, so the URL-keyed special case must                        // not exempt the rest of the KeyValue from the scrub.                        extraValue: `https://app.test/x?owner=${SECRET}-kv-inner`,                      },                      note: `retry of https://app.test/x?owner=${SECRET}-kv-sibling`,                    },                    { key: "url.query", value: { stringValue: `code=${SECRET}-code` } },                  ],                  events: [                    {                      name: "exception",                      timeUnixNano: "1",                      attributes: [                        {                          key: "exception.message",                          value: {                            stringValue: `GET https://u:${SECRET}-userinfo@api.test/x?key=${SECRET}-key failed`,                          },                        },                      ],                    },                  ],                  status: {                    code: 2,                    message: `GET https://api.test/x?key=${SECRET}-status failed`,                  },                },              ],            },          ],        },      ],    };    let forwarded: string | undefined;    const response = await browserTracesResponse(      makeRequest({        headers: { cookie: "wos-session=abc" },        body: JSON.stringify(payload),      }),      baseEnv,      (async (_url: RequestInfo | URL, init?: RequestInit) => {        forwarded = await new Response(init?.body as BodyInit).text();        return new Response(null, { status: 200 });      }) as typeof fetch,    );    expect(response?.status).toBe(204);    expect(forwarded).toBeDefined();    expect(forwarded).not.toContain(SECRET);    // Non-vacuous: the span, its route, and its trace identity survive.    expect(forwarded).toContain("/api/oauth/callback");    expect(forwarded).toContain("0af7651916cd43dd8448eb211c80319c");    expect(forwarded).toContain("exception");  });   it("rejects an unparseable batch instead of forwarding it unscrubbed", async () => {    let forwardedCount = 0;    const response = await browserTracesResponse(      makeRequest({        headers: { cookie: "wos-session=abc" },        body: `not-json ?token=synthetic-unparsed-secret`,      }),      baseEnv,      (async () => {        forwardedCount += 1;        return new Response(null, { status: 200 });      }) as typeof fetch,    );    expect(response?.status).toBe(400);    expect(forwardedCount).toBe(0);  });   it("reports upstream failure as 502 without leaking detail", async () => {    const response = await browserTracesResponse(      makeRequest({ headers: { cookie: "wos-session=abc" } }),      baseEnv,      (async () => new Response("denied", { status: 403 })) as typeof fetch,    );    expect(response?.status).toBe(502);  });   it("refuses oversized batches", async () => {    const response = await browserTracesResponse(      makeRequest({        headers: {          cookie: "wos-session=abc",          "content-length": String(3_000_000),        },      }),      baseEnv,    );    expect(response?.status).toBe(413);  });   it("only accepts POST", async () => {    const response = await browserTracesResponse(      new Request("https://executor.sh/v1/traces", { method: "GET" }),      baseEnv,    );    expect(response?.status).toBe(405);  });});