import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";import { describe, expect, it } from "@effect/vitest";import { Context, Effect, Layer, Predicate, type Scope } from "effect";import { HttpServer, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"; import {  AuthTemplateSlug,  ConnectionName,  IntegrationSlug,  OAuthClientSlug,  ToolName,} from "./ids";import type { AuthMethodDescriptor } from "./integration";import { definePlugin, type IntegrationRecord } from "./plugin";import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";import { serveOAuthTestServer } from "./testing/oauth-test-server"; // Integration-driven scopes: at connect, `oauth.start` requests EXACTLY the// integration's DECLARED oauth scopes. The OAuth app carries no scope set of its// own, so there is no union and no over-request — the integration is the sole// source of what to request. (Replaces the earlier declared∪client union model.) const INTEG = IntegrationSlug.make("acme");const TEMPLATE = AuthTemplateSlug.make("oauth");const CLIENT = OAuthClientSlug.make("acme-app"); // The integration's DECLARED oauth scopes — the sole source of the request.const DECLARED_SCOPES = ["calendar", "gmail", "drive", "sheets"] as const; /** A plugin whose integration config carries declared oauth scopes, projected *  into an oauth `AuthMethodDescriptor` via `describeAuthMethods` — exactly the *  shape `resolveDeclaredOAuthScopes` reads. `scopes: null` ⇒ no declared oauth *  scopes (the MCP/no-template-scopes case). */const makeScopePlugin = (config: { readonly scopes: readonly string[] | null }) =>  definePlugin(() => ({    id: "acme" as const,    storage: () => ({}),    resolveTools: () =>      Effect.succeed({        tools: [{ name: ToolName.make("whoami"), description: "whoami" }],      }),    invokeTool: ({ credential }) => Effect.succeed({ token: credential.value }),    describeAuthMethods: (record: IntegrationRecord): readonly AuthMethodDescriptor[] => {      const cfg = record.config as { readonly scopes?: readonly string[] | null } | null;      const scopes = cfg?.scopes;      if (scopes == null) {        // No declared oauth scopes — the integration declares an oauth method        // with no template scopes (MCP/DCR-style). Declared scopes resolve to [].        return [{ id: "oauth", label: "OAuth2", kind: "oauth", template: String(TEMPLATE) }];      }      return [        {          id: "oauth",          label: "OAuth2",          kind: "oauth",          template: String(TEMPLATE),          oauth: { scopes },        },      ];    },    extension: (ctx) => ({      seed: () =>        ctx.core.integrations.register({          slug: INTEG,          description: "Acme",          config: { scopes: config.scopes },        }),    }),  }))(); /** Parse the `scope` query param from an authorize URL into an ordered list. */const scopesFromAuthorizeUrl = (authorizationUrl: string): readonly string[] => {  const raw = new URL(authorizationUrl).searchParams.get("scope");  return raw == null || raw.length === 0 ? [] : raw.split(" ");}; describe("oauth.start integration-driven scopes", () => {  it.effect(    "(a) requests exactly the integration's declared scopes (the app contributes none)",    () =>      Effect.scoped(        Effect.gen(function* () {          const server = yield* serveOAuthTestServer({ scopes: [...DECLARED_SCOPES] });          const plugins = [            memoryCredentialsPlugin(),            makeScopePlugin({ scopes: DECLARED_SCOPES }),          ] as const;          const { executor } = yield* makeTestWorkspaceHarness({ plugins });          yield* executor.acme.seed();           // The app is pure identity — no scope set.          yield* executor.oauth.createClient({            owner: "org",            slug: CLIENT,            authorizationUrl: server.authorizationEndpoint,            tokenUrl: server.tokenEndpoint,            grant: "authorization_code",            clientId: "test-client",            clientSecret: "test-secret",          });           const started = yield* executor.oauth.start({            owner: "org",            client: CLIENT,            clientOwner: "org",            name: ConnectionName.make("main"),            integration: INTEG,            template: TEMPLATE,          });          expect(started.status).toBe("redirect");          if (started.status !== "redirect") return;           // The authorize URL requests exactly the integration's declared scopes.          expect(scopesFromAuthorizeUrl(started.authorizationUrl)).toEqual([...DECLARED_SCOPES]);        }),      ),  );   it.effect("(b) when the integration declares no oauth scopes, start requests none", () =>    Effect.scoped(      Effect.gen(function* () {        const server = yield* serveOAuthTestServer({ scopes: [] });        // `scopes: null` ⇒ the integration declares an oauth method with no        // template scopes ⇒ declared scopes resolve to [] ⇒ no scope is requested.        const plugins = [memoryCredentialsPlugin(), makeScopePlugin({ scopes: null })] as const;        const { executor } = yield* makeTestWorkspaceHarness({ plugins });        yield* executor.acme.seed();         yield* executor.oauth.createClient({          owner: "org",          slug: CLIENT,          authorizationUrl: server.authorizationEndpoint,          tokenUrl: server.tokenEndpoint,          grant: "authorization_code",          clientId: "test-client",          clientSecret: "test-secret",        });         const started = yield* executor.oauth.start({          owner: "org",          client: CLIENT,          clientOwner: "org",          name: ConnectionName.make("main"),          integration: INTEG,          template: TEMPLATE,        });        expect(started.status).toBe("redirect");        if (started.status !== "redirect") return;         expect(scopesFromAuthorizeUrl(started.authorizationUrl)).toEqual([]);      }),    ),  );}); // -----------------------------------------------------------------------------// (c) The recorded `oauth_scope` reflects the requested (declared) scopes when// the AS omits `scope`. A minimal inline token endpoint handles the// client_credentials grant and deliberately OMITS `scope` from its response,// forcing the recorded-scope fallback (`token.scope ?? requested.join(" ")`).// ----------------------------------------------------------------------------- /** A minimal token endpoint serving the client_credentials grant and OMITTING *  `scope` from its response, forcing the recorded-scope fallback. Returns a *  scoped effect (mirrors `serveOAuthTestServer`); `yield*` it inside an already *  `Effect.scoped` test. */const serveScopelessTokenServer = (): Effect.Effect<  { readonly tokenEndpoint: string },  unknown,  Scope.Scope> =>  Effect.gen(function* () {    const context = yield* Layer.build(      Layer.fresh(        HttpServer.serve(          HttpServerRequest.HttpServerRequest.asEffect().pipe(            Effect.map((request: HttpServerRequest.HttpServerRequest) => {              if (request.url.startsWith("/token") && request.method === "POST") {                // A Bearer access token WITHOUT a `scope` field — the AS omits                // it, so the recorded scope falls back to the requested set.                return HttpServerResponse.jsonUnsafe(                  {                    access_token: `at_${Math.random().toString(36).slice(2)}`,                    token_type: "Bearer",                    expires_in: 3600,                  },                  { status: 200, headers: { "cache-control": "no-store" } },                );              }              return HttpServerResponse.jsonUnsafe({ error: "not_found" }, { status: 404 });            }),          ),        ).pipe(Layer.provideMerge(NodeHttpServer.layerTest)),      ),    );    const server = Context.get(context, HttpServer.HttpServer);    const address = server.address;    if (!Predicate.isTagged(address, "TcpAddress")) {      return yield* Effect.die(`Expected a TcpAddress, got ${JSON.stringify(address)}`);    }    return { tokenEndpoint: `http://127.0.0.1:${address.port}/token` };  }); describe("oauth.start recorded scope fallback", () => {  it.effect(    "(c) records the requested (declared) scopes when the authorization server omits scope",    () =>      Effect.scoped(        Effect.gen(function* () {          const tokenServer = yield* serveScopelessTokenServer();          const plugins = [            memoryCredentialsPlugin(),            makeScopePlugin({ scopes: DECLARED_SCOPES }),          ] as const;          const { executor, config } = yield* makeTestWorkspaceHarness({ plugins });          yield* executor.acme.seed();           // A client_credentials client so `start` mints inline (no redirect),          // exchanging against the scopeless token endpoint.          yield* executor.oauth.createClient({            owner: "org",            slug: CLIENT,            authorizationUrl: "http://127.0.0.1/authorize",            tokenUrl: tokenServer.tokenEndpoint,            grant: "client_credentials",            clientId: "test-client",            clientSecret: "test-secret",          });           const started = yield* executor.oauth.start({            owner: "org",            client: CLIENT,            clientOwner: "org",            name: ConnectionName.make("cc"),            integration: INTEG,            template: TEMPLATE,          });          expect(started.status).toBe("connected");           // The connection's recorded `oauth_scope` is the requested (declared) set          // since the AS omitted `scope`.          const row = yield* Effect.promise(() =>            config.db.findFirst("connection", {              where: (b) => b("name", "=", "cc"),            }),          );          expect(row?.oauth_scope).toBe("calendar gmail drive sheets");        }),      ),  );});