// Tenant isolation integration test. Runs in plain node (not workerd)// via vitest.node.config.ts — workerd's dev-mode compile stack crashes// on the full cloud module graph. import { describe, expect, it } from "@effect/vitest";import { Effect, Result } from "effect"; import { ConnectionId, ScopeId, SecretId } from "@executor-js/sdk"; import { asOrg } from "./__test-harness__/api-harness"; const MINIMAL_OPENAPI_SPEC = JSON.stringify({ openapi: "3.0.0", info: { title: "Tenant Test API", version: "1.0.0" }, paths: { "/ping": { get: { operationId: "ping", responses: { "200": { description: "ok" } }, }, }, },}); describe("tenant isolation (HTTP)", () => { it.effect("write requests cannot target another org scope", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const result = yield* asOrg(orgB, (client) => client.secrets.set({ params: { scopeId: ScopeId.make(orgA) }, payload: { id: SecretId.make("planted"), name: "planted-by-org-b", value: "should-be-rejected", }, }), ).pipe(Effect.result); expect(Result.isFailure(result)).toBe(true); const orgASecrets = yield* asOrg(orgA, (client) => client.secrets.list({ params: { scopeId: ScopeId.make(orgA) } }), ); expect(orgASecrets.map((s) => s.id)).not.toContain("planted"); }), ); it.effect("read requests with another org scope still use the caller stack", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const idA = `sec_a_${crypto.randomUUID().slice(0, 8)}`; yield* asOrg(orgA, (client) => client.secrets.set({ params: { scopeId: ScopeId.make(orgA) }, payload: { id: SecretId.make(idA), name: "org-a only", value: "v" }, }), ); const result = yield* asOrg(orgB, (client) => client.secrets.list({ params: { scopeId: ScopeId.make(orgA) } }), ); expect(result.map((s) => s.id)).not.toContain(idA); }), ); it.effect("delete requests cannot remove another org secret", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const idA = `sec_a_${crypto.randomUUID().slice(0, 8)}`; yield* asOrg(orgA, (client) => client.secrets.set({ params: { scopeId: ScopeId.make(orgA) }, payload: { id: SecretId.make(idA), name: "org-a only", value: "v" }, }), ); yield* asOrg(orgB, (client) => client.secrets.remove({ params: { scopeId: ScopeId.make(orgA), secretId: SecretId.make(idA) }, }), ).pipe(Effect.result); const status = yield* asOrg(orgA, (client) => client.secrets.status({ params: { scopeId: ScopeId.make(orgA), secretId: SecretId.make(idA) }, }), ); expect(status.status).toBe("resolved"); }), ); it.effect("sources.list is scoped to the caller org", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const namespaceA = `a_${crypto.randomUUID().replace(/-/g, "_")}`; yield* asOrg(orgA, (client) => client.openapi.addSpec({ params: { scopeId: ScopeId.make(orgA) }, payload: { targetScope: ScopeId.make(orgA), spec: MINIMAL_OPENAPI_SPEC, namespace: namespaceA, }, }), ); const orgBSources = yield* asOrg(orgB, (client) => client.sources.list({ params: { scopeId: ScopeId.make(orgB) } }), ); expect(orgBSources.map((s) => s.id)).not.toContain(namespaceA); }), ); it.effect("tools.list is scoped to the caller org", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const namespaceA = `a_${crypto.randomUUID().replace(/-/g, "_")}`; yield* asOrg(orgA, (client) => client.openapi.addSpec({ params: { scopeId: ScopeId.make(orgA) }, payload: { targetScope: ScopeId.make(orgA), spec: MINIMAL_OPENAPI_SPEC, namespace: namespaceA, }, }), ); const orgBTools = yield* asOrg(orgB, (client) => client.tools.list({ params: { scopeId: ScopeId.make(orgB) } }), ); expect(orgBTools.map((t) => t.sourceId)).not.toContain(namespaceA); for (const id of orgBTools.map((t) => t.id)) { expect(id).not.toContain(namespaceA); } }), ); it.effect("openapi.getSource cannot reach another org's source by namespace", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const namespaceA = `a_${crypto.randomUUID().replace(/-/g, "_")}`; yield* asOrg(orgA, (client) => client.openapi.addSpec({ params: { scopeId: ScopeId.make(orgA) }, payload: { targetScope: ScopeId.make(orgA), spec: MINIMAL_OPENAPI_SPEC, namespace: namespaceA, }, }), ); const source = yield* asOrg(orgB, (client) => client.openapi.getSource({ params: { scopeId: ScopeId.make(orgB), namespace: namespaceA }, }), ); expect(source).toBeNull(); }), ); it.effect("secrets.list is scoped to the caller org", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const secretIdA = `sec_a_${crypto.randomUUID().slice(0, 8)}`; yield* asOrg(orgA, (client) => client.secrets.set({ params: { scopeId: ScopeId.make(orgA) }, payload: { id: SecretId.make(secretIdA), name: "org-a only", value: "super-secret-a" }, }), ); const orgBSecrets = yield* asOrg(orgB, (client) => client.secrets.list({ params: { scopeId: ScopeId.make(orgB) } }), ); expect(orgBSecrets.map((s) => s.id)).not.toContain(secretIdA); }), ); it.effect("secrets.status reports another org's secret as missing", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const secretIdA = `sec_a_${crypto.randomUUID().slice(0, 8)}`; yield* asOrg(orgA, (client) => client.secrets.set({ params: { scopeId: ScopeId.make(orgA) }, payload: { id: SecretId.make(secretIdA), name: "org-a only", value: "super-secret-a" }, }), ); const status = yield* asOrg(orgB, (client) => client.secrets.status({ params: { scopeId: ScopeId.make(orgB), secretId: SecretId.make(secretIdA) }, }), ); expect(status.status).toBe("missing"); }), ); it.effect("secret metadata is not visible across orgs", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const secretIdA = `sec_a_${crypto.randomUUID().slice(0, 8)}`; yield* asOrg(orgA, (client) => client.secrets.set({ params: { scopeId: ScopeId.make(orgA) }, payload: { id: SecretId.make(secretIdA), name: "org-a only", value: "super-secret-a" }, }), ); const status = yield* asOrg(orgB, (client) => client.secrets.status({ params: { scopeId: ScopeId.make(orgB), secretId: SecretId.make(secretIdA) }, }), ); const list = yield* asOrg(orgB, (client) => client.secrets.list({ params: { scopeId: ScopeId.make(orgB) } }), ); expect(status.status).toBe("missing"); expect(list.map((s) => s.id)).not.toContain(secretIdA); }), ); it.effect("secret usages are scoped to the caller stack", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const namespaceA = `a_${crypto.randomUUID().replace(/-/g, "_")}`; const secretIdA = SecretId.make(`sec_a_${crypto.randomUUID().slice(0, 8)}`); yield* asOrg(orgA, (client) => Effect.gen(function* () { yield* client.secrets.set({ params: { scopeId: ScopeId.make(orgA) }, payload: { id: secretIdA, name: "org-a token", value: "v" }, }); yield* client.openapi.addSpec({ params: { scopeId: ScopeId.make(orgA) }, payload: { targetScope: ScopeId.make(orgA), spec: MINIMAL_OPENAPI_SPEC, namespace: namespaceA, headers: { Authorization: { kind: "binding", slot: "auth:token", prefix: "Bearer ", }, }, }, }); yield* client.openapi.setSourceBinding({ params: { scopeId: ScopeId.make(orgA) }, payload: { sourceId: namespaceA, sourceScope: ScopeId.make(orgA), scope: ScopeId.make(orgA), slot: "auth:token", value: { kind: "secret", secretId: secretIdA }, }, }); }), ); const usages = yield* asOrg(orgB, (client) => client.secrets.usages({ params: { scopeId: ScopeId.make(orgB), secretId: secretIdA }, }), ); expect(usages).toEqual([]); }), ); it.effect("connection usages are scoped to the caller stack", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const namespaceA = `a_${crypto.randomUUID().replace(/-/g, "_")}`; const connectionIdA = ConnectionId.make(`conn_a_${crypto.randomUUID().slice(0, 8)}`); yield* asOrg(orgA, (client) => Effect.gen(function* () { yield* client.openapi.addSpec({ params: { scopeId: ScopeId.make(orgA) }, payload: { targetScope: ScopeId.make(orgA), spec: MINIMAL_OPENAPI_SPEC, namespace: namespaceA, headers: { Authorization: { kind: "binding", slot: "auth:conn", prefix: "Bearer ", }, }, }, }); yield* client.openapi.setSourceBinding({ params: { scopeId: ScopeId.make(orgA) }, payload: { sourceId: namespaceA, sourceScope: ScopeId.make(orgA), scope: ScopeId.make(orgA), slot: "auth:conn", value: { kind: "connection", connectionId: connectionIdA }, }, }); }), ).pipe(Effect.result); const usages = yield* asOrg(orgB, (client) => client.connections.usages({ params: { scopeId: ScopeId.make(orgB), connectionId: connectionIdA }, }), ); expect(usages).toEqual([]); }), ); it.effect("updating a same-namespace OpenAPI source in one org does not mutate another org", () => Effect.gen(function* () { const orgA = `org_${crypto.randomUUID()}`; const orgB = `org_${crypto.randomUUID()}`; const namespace = `shared_${crypto.randomUUID().replace(/-/g, "_")}`; yield* asOrg(orgA, (client) => client.openapi.addSpec({ params: { scopeId: ScopeId.make(orgA) }, payload: { targetScope: ScopeId.make(orgA), spec: MINIMAL_OPENAPI_SPEC, namespace, name: "Org A API", baseUrl: "https://org-a.example.com", }, }), ); yield* asOrg(orgB, (client) => client.openapi.addSpec({ params: { scopeId: ScopeId.make(orgB) }, payload: { targetScope: ScopeId.make(orgB), spec: MINIMAL_OPENAPI_SPEC, namespace, name: "Org B API", baseUrl: "https://org-b.example.com", }, }), ); yield* asOrg(orgA, (client) => client.openapi.updateSource({ params: { scopeId: ScopeId.make(orgA), namespace }, payload: { sourceScope: ScopeId.make(orgA), name: "Org A Updated API", baseUrl: "https://org-a-updated.example.com", }, }), ); const orgASource = yield* asOrg(orgA, (client) => client.openapi.getSource({ params: { scopeId: ScopeId.make(orgA), namespace } }), ); const orgBSource = yield* asOrg(orgB, (client) => client.openapi.getSource({ params: { scopeId: ScopeId.make(orgB), namespace } }), ); expect(orgASource?.name).toBe("Org A Updated API"); expect(orgASource?.config.baseUrl).toBe("https://org-a-updated.example.com"); expect(orgBSource?.name).toBe("Org B API"); expect(orgBSource?.config.baseUrl).toBe("https://org-b.example.com"); }), );});
// Tenant isolation integration test. Runs in plain node (not workerd)
// via vitest.node.config.ts — workerd's dev-mode compile stack crashes
// on the full cloud module graph.
import { describe, expect, it } from "@effect/vitest";
import { Effect, Result } from "effect";
import { ConnectionId, ScopeId, SecretId } from "@executor-js/sdk";
import { asOrg } from "./__test-harness__/api-harness";
const MINIMAL_OPENAPI_SPEC = JSON.stringify({
openapi: "3.0.0",
info: { title: "Tenant Test API", version: "1.0.0" },
paths: {
"/ping": {
get: {
operationId: "ping",
responses: { "200": { description: "ok" } },
},
},
},
});
describe("tenant isolation (HTTP)", () => {
it.effect("write requests cannot target another org scope", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const result = yield* asOrg(orgB, (client) =>
client.secrets.set({
params: { scopeId: ScopeId.make(orgA) },
payload: {
id: SecretId.make("planted"),
name: "planted-by-org-b",
value: "should-be-rejected",
},
}),
).pipe(Effect.result);
expect(Result.isFailure(result)).toBe(true);
const orgASecrets = yield* asOrg(orgA, (client) =>
client.secrets.list({ params: { scopeId: ScopeId.make(orgA) } }),
);
expect(orgASecrets.map((s) => s.id)).not.toContain("planted");
}),
);
it.effect("read requests with another org scope still use the caller stack", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const idA = `sec_a_${crypto.randomUUID().slice(0, 8)}`;
yield* asOrg(orgA, (client) =>
client.secrets.set({
params: { scopeId: ScopeId.make(orgA) },
payload: { id: SecretId.make(idA), name: "org-a only", value: "v" },
}),
);
const result = yield* asOrg(orgB, (client) =>
client.secrets.list({ params: { scopeId: ScopeId.make(orgA) } }),
);
expect(result.map((s) => s.id)).not.toContain(idA);
}),
);
it.effect("delete requests cannot remove another org secret", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const idA = `sec_a_${crypto.randomUUID().slice(0, 8)}`;
yield* asOrg(orgA, (client) =>
client.secrets.set({
params: { scopeId: ScopeId.make(orgA) },
payload: { id: SecretId.make(idA), name: "org-a only", value: "v" },
}),
);
yield* asOrg(orgB, (client) =>
client.secrets.remove({
params: { scopeId: ScopeId.make(orgA), secretId: SecretId.make(idA) },
}),
).pipe(Effect.result);
const status = yield* asOrg(orgA, (client) =>
client.secrets.status({
params: { scopeId: ScopeId.make(orgA), secretId: SecretId.make(idA) },
}),
);
expect(status.status).toBe("resolved");
}),
);
it.effect("sources.list is scoped to the caller org", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const namespaceA = `a_${crypto.randomUUID().replace(/-/g, "_")}`;
yield* asOrg(orgA, (client) =>
client.openapi.addSpec({
params: { scopeId: ScopeId.make(orgA) },
payload: {
targetScope: ScopeId.make(orgA),
spec: MINIMAL_OPENAPI_SPEC,
namespace: namespaceA,
},
}),
);
const orgBSources = yield* asOrg(orgB, (client) =>
client.sources.list({ params: { scopeId: ScopeId.make(orgB) } }),
);
expect(orgBSources.map((s) => s.id)).not.toContain(namespaceA);
}),
);
it.effect("tools.list is scoped to the caller org", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const namespaceA = `a_${crypto.randomUUID().replace(/-/g, "_")}`;
yield* asOrg(orgA, (client) =>
client.openapi.addSpec({
params: { scopeId: ScopeId.make(orgA) },
payload: {
targetScope: ScopeId.make(orgA),
spec: MINIMAL_OPENAPI_SPEC,
namespace: namespaceA,
},
}),
);
const orgBTools = yield* asOrg(orgB, (client) =>
client.tools.list({ params: { scopeId: ScopeId.make(orgB) } }),
);
expect(orgBTools.map((t) => t.sourceId)).not.toContain(namespaceA);
for (const id of orgBTools.map((t) => t.id)) {
expect(id).not.toContain(namespaceA);
}
}),
);
it.effect("openapi.getSource cannot reach another org's source by namespace", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const namespaceA = `a_${crypto.randomUUID().replace(/-/g, "_")}`;
yield* asOrg(orgA, (client) =>
client.openapi.addSpec({
params: { scopeId: ScopeId.make(orgA) },
payload: {
targetScope: ScopeId.make(orgA),
spec: MINIMAL_OPENAPI_SPEC,
namespace: namespaceA,
},
}),
);
const source = yield* asOrg(orgB, (client) =>
client.openapi.getSource({
params: { scopeId: ScopeId.make(orgB), namespace: namespaceA },
}),
);
expect(source).toBeNull();
}),
);
it.effect("secrets.list is scoped to the caller org", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const secretIdA = `sec_a_${crypto.randomUUID().slice(0, 8)}`;
yield* asOrg(orgA, (client) =>
client.secrets.set({
params: { scopeId: ScopeId.make(orgA) },
payload: { id: SecretId.make(secretIdA), name: "org-a only", value: "super-secret-a" },
}),
);
const orgBSecrets = yield* asOrg(orgB, (client) =>
client.secrets.list({ params: { scopeId: ScopeId.make(orgB) } }),
);
expect(orgBSecrets.map((s) => s.id)).not.toContain(secretIdA);
}),
);
it.effect("secrets.status reports another org's secret as missing", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const secretIdA = `sec_a_${crypto.randomUUID().slice(0, 8)}`;
yield* asOrg(orgA, (client) =>
client.secrets.set({
params: { scopeId: ScopeId.make(orgA) },
payload: { id: SecretId.make(secretIdA), name: "org-a only", value: "super-secret-a" },
}),
);
const status = yield* asOrg(orgB, (client) =>
client.secrets.status({
params: { scopeId: ScopeId.make(orgB), secretId: SecretId.make(secretIdA) },
}),
);
expect(status.status).toBe("missing");
}),
);
it.effect("secret metadata is not visible across orgs", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const secretIdA = `sec_a_${crypto.randomUUID().slice(0, 8)}`;
yield* asOrg(orgA, (client) =>
client.secrets.set({
params: { scopeId: ScopeId.make(orgA) },
payload: { id: SecretId.make(secretIdA), name: "org-a only", value: "super-secret-a" },
}),
);
const status = yield* asOrg(orgB, (client) =>
client.secrets.status({
params: { scopeId: ScopeId.make(orgB), secretId: SecretId.make(secretIdA) },
}),
);
const list = yield* asOrg(orgB, (client) =>
client.secrets.list({ params: { scopeId: ScopeId.make(orgB) } }),
);
expect(status.status).toBe("missing");
expect(list.map((s) => s.id)).not.toContain(secretIdA);
}),
);
it.effect("secret usages are scoped to the caller stack", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const namespaceA = `a_${crypto.randomUUID().replace(/-/g, "_")}`;
const secretIdA = SecretId.make(`sec_a_${crypto.randomUUID().slice(0, 8)}`);
yield* asOrg(orgA, (client) =>
Effect.gen(function* () {
yield* client.secrets.set({
params: { scopeId: ScopeId.make(orgA) },
payload: { id: secretIdA, name: "org-a token", value: "v" },
});
yield* client.openapi.addSpec({
params: { scopeId: ScopeId.make(orgA) },
payload: {
targetScope: ScopeId.make(orgA),
spec: MINIMAL_OPENAPI_SPEC,
namespace: namespaceA,
headers: {
Authorization: {
kind: "binding",
slot: "auth:token",
prefix: "Bearer ",
},
},
},
});
yield* client.openapi.setSourceBinding({
params: { scopeId: ScopeId.make(orgA) },
payload: {
sourceId: namespaceA,
sourceScope: ScopeId.make(orgA),
scope: ScopeId.make(orgA),
slot: "auth:token",
value: { kind: "secret", secretId: secretIdA },
},
});
}),
);
const usages = yield* asOrg(orgB, (client) =>
client.secrets.usages({
params: { scopeId: ScopeId.make(orgB), secretId: secretIdA },
}),
);
expect(usages).toEqual([]);
}),
);
it.effect("connection usages are scoped to the caller stack", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const namespaceA = `a_${crypto.randomUUID().replace(/-/g, "_")}`;
const connectionIdA = ConnectionId.make(`conn_a_${crypto.randomUUID().slice(0, 8)}`);
yield* asOrg(orgA, (client) =>
Effect.gen(function* () {
yield* client.openapi.addSpec({
params: { scopeId: ScopeId.make(orgA) },
payload: {
targetScope: ScopeId.make(orgA),
spec: MINIMAL_OPENAPI_SPEC,
namespace: namespaceA,
headers: {
Authorization: {
kind: "binding",
slot: "auth:conn",
prefix: "Bearer ",
},
},
},
});
yield* client.openapi.setSourceBinding({
params: { scopeId: ScopeId.make(orgA) },
payload: {
sourceId: namespaceA,
sourceScope: ScopeId.make(orgA),
scope: ScopeId.make(orgA),
slot: "auth:conn",
value: { kind: "connection", connectionId: connectionIdA },
},
});
}),
).pipe(Effect.result);
const usages = yield* asOrg(orgB, (client) =>
client.connections.usages({
params: { scopeId: ScopeId.make(orgB), connectionId: connectionIdA },
}),
);
expect(usages).toEqual([]);
}),
);
it.effect("updating a same-namespace OpenAPI source in one org does not mutate another org", () =>
Effect.gen(function* () {
const orgA = `org_${crypto.randomUUID()}`;
const orgB = `org_${crypto.randomUUID()}`;
const namespace = `shared_${crypto.randomUUID().replace(/-/g, "_")}`;
yield* asOrg(orgA, (client) =>
client.openapi.addSpec({
params: { scopeId: ScopeId.make(orgA) },
payload: {
targetScope: ScopeId.make(orgA),
spec: MINIMAL_OPENAPI_SPEC,
namespace,
name: "Org A API",
baseUrl: "https://org-a.example.com",
},
}),
);
yield* asOrg(orgB, (client) =>
client.openapi.addSpec({
params: { scopeId: ScopeId.make(orgB) },
payload: {
targetScope: ScopeId.make(orgB),
spec: MINIMAL_OPENAPI_SPEC,
namespace,
name: "Org B API",
baseUrl: "https://org-b.example.com",
},
}),
);
yield* asOrg(orgA, (client) =>
client.openapi.updateSource({
params: { scopeId: ScopeId.make(orgA), namespace },
payload: {
sourceScope: ScopeId.make(orgA),
name: "Org A Updated API",
baseUrl: "https://org-a-updated.example.com",
},
}),
);
const orgASource = yield* asOrg(orgA, (client) =>
client.openapi.getSource({ params: { scopeId: ScopeId.make(orgA), namespace } }),
);
const orgBSource = yield* asOrg(orgB, (client) =>
client.openapi.getSource({ params: { scopeId: ScopeId.make(orgB), namespace } }),
);
expect(orgASource?.name).toBe("Org A Updated API");
expect(orgASource?.config.baseUrl).toBe("https://org-a-updated.example.com");
expect(orgBSource?.name).toBe("Org B API");
expect(orgBSource?.config.baseUrl).toBe("https://org-b.example.com");
}),
);
});