import { describe, it, expect } from "@effect/vitest";import { Data, Effect, Layer } from "effect"; import { AuthContext } from "@executor-js/api/server";import { WorkOSClient, type WorkOSClientService } from "../auth/workos";import { Forbidden } from "./api"; // ---------------------------------------------------------------------------// Domain-handler guards. The member / role / invite / org-name endpoints moved// to the shared WorkOS `AccountProvider` (covered by// `workos-account-service.test.ts`); this group now serves only the WorkOS// domain-verification endpoints. These tests pin the two guards those handlers// share — `requireAdmin` and `assertDomainInSessionOrg` — which mirror// `org/handlers.ts`.// --------------------------------------------------------------------------- // eslint-disable-next-line @typescript-eslint/no-explicit-any -- test stub needs wide function typestype StubFn = (...args: never[]) => Effect.Effect<any, any>; type StubOverrides = { getUserOrgMembership?: StubFn; getOrganizationDomain?: StubFn; getOrganization?: StubFn; deleteOrganizationDomain?: StubFn;}; class UnstubbedWorkOSMethod extends Data.TaggedError("UnstubbedWorkOSMethod")<{ method: string;}> {} const stubWorkOS = (overrides: StubOverrides = {}) => Layer.succeed( WorkOSClient, new Proxy({} as WorkOSClientService, { get: (_target, prop) => { if (typeof prop === "string" && prop in overrides) { return overrides[prop as keyof StubOverrides]; } return () => Effect.fail( new UnstubbedWorkOSMethod({ method: typeof prop === "string" ? prop : (prop.description ?? "symbol"), }), ); }, }), ); const adminAuth = { accountId: "user_admin", organizationId: "org_1", email: "admin@test.com", name: "Admin", avatarUrl: null, roles: [],}; const memberAuth = { accountId: "user_member", organizationId: "org_1", email: "member@test.com", name: "Member", avatarUrl: null, roles: [],}; const provide = (auth: typeof adminAuth, workosOverrides: StubOverrides = {}) => Layer.mergeAll(Layer.succeed(AuthContext)(auth), stubWorkOS(workosOverrides)); // Mirrors `org/handlers.ts` `requireAdmin`.const requireAdmin = Effect.gen(function* () { const auth = yield* AuthContext; const workos = yield* WorkOSClient; const current = yield* workos.getUserOrgMembership(auth.organizationId, auth.accountId); if (!current || current.role?.slug !== "admin") { return yield* new Forbidden(); }}); const withCurrentMembership: StubOverrides = { getUserOrgMembership: (_organizationId: string, userId: string) => Effect.succeed( userId === "user_admin" ? { id: "mem_admin", userId, status: "active", role: { slug: "admin" } } : { id: "mem_member", userId, status: "active", role: { slug: "member" } }, ),}; // Mirrors `org/handlers.ts` `assertDomainInSessionOrg`.const assertDomainInSessionOrg = (domainId: string) => Effect.gen(function* () { const auth = yield* AuthContext; const workos = yield* WorkOSClient; const domain = yield* workos .getOrganizationDomain(domainId) .pipe(Effect.catchCause(() => Effect.succeed(null))); if (!domain || domain.organizationId !== auth.organizationId) { return yield* new Forbidden(); } }); describe("Org domain handlers", () => { describe("requireAdmin", () => { it.effect("passes for an admin caller", () => requireAdmin.pipe(Effect.provide(provide(adminAuth, withCurrentMembership))), ); it.effect("rejects a non-admin caller with Forbidden", () => Effect.gen(function* () { const error = yield* Effect.flip(requireAdmin); expect(error).toBeInstanceOf(Forbidden); }).pipe(Effect.provide(provide(memberAuth, withCurrentMembership))), ); }); describe("assertDomainInSessionOrg", () => { it.effect("passes when the domain belongs to the session org", () => assertDomainInSessionOrg("dom_1").pipe( Effect.provide( provide(adminAuth, { getOrganizationDomain: () => Effect.succeed({ id: "dom_1", organizationId: "org_1", domain: "acme.test" }), }), ), ), ); it.effect("rejects a domain owned by a different org with Forbidden", () => Effect.gen(function* () { const error = yield* Effect.flip(assertDomainInSessionOrg("dom_other")); expect(error).toBeInstanceOf(Forbidden); }).pipe( Effect.provide( provide(adminAuth, { getOrganizationDomain: () => Effect.succeed({ id: "dom_other", organizationId: "org_2", domain: "evil.test" }), }), ), ), ); it.effect("rejects (Forbidden) when the domain lookup fails — never leaks existence", () => Effect.gen(function* () { const error = yield* Effect.flip(assertDomainInSessionOrg("dom_missing")); expect(error).toBeInstanceOf(Forbidden); }).pipe( Effect.provide( provide(adminAuth, { getOrganizationDomain: () => Effect.fail(new UnstubbedWorkOSMethod({ method: "boom" })), }), ), ), ); });});
import { describe, it, expect } from "@effect/vitest";
import { Data, Effect, Layer } from "effect";
import { AuthContext } from "@executor-js/api/server";
import { WorkOSClient, type WorkOSClientService } from "../auth/workos";
import { Forbidden } from "./api";
// ---------------------------------------------------------------------------
// Domain-handler guards. The member / role / invite / org-name endpoints moved
// to the shared WorkOS `AccountProvider` (covered by
// `workos-account-service.test.ts`); this group now serves only the WorkOS
// domain-verification endpoints. These tests pin the two guards those handlers
// share — `requireAdmin` and `assertDomainInSessionOrg` — which mirror
// `org/handlers.ts`.
// ---------------------------------------------------------------------------
// eslint-disable-next-line @typescript-eslint/no-explicit-any -- test stub needs wide function types
type StubFn = (...args: never[]) => Effect.Effect<any, any>;
type StubOverrides = {
getUserOrgMembership?: StubFn;
getOrganizationDomain?: StubFn;
getOrganization?: StubFn;
deleteOrganizationDomain?: StubFn;
};
class UnstubbedWorkOSMethod extends Data.TaggedError("UnstubbedWorkOSMethod")<{
method: string;
}> {}
const stubWorkOS = (overrides: StubOverrides = {}) =>
Layer.succeed(
WorkOSClient,
new Proxy({} as WorkOSClientService, {
get: (_target, prop) => {
if (typeof prop === "string" && prop in overrides) {
return overrides[prop as keyof StubOverrides];
}
return () =>
Effect.fail(
new UnstubbedWorkOSMethod({
method: typeof prop === "string" ? prop : (prop.description ?? "symbol"),
}),
);
},
}),
);
const adminAuth = {
accountId: "user_admin",
organizationId: "org_1",
email: "admin@test.com",
name: "Admin",
avatarUrl: null,
roles: [],
};
const memberAuth = {
accountId: "user_member",
organizationId: "org_1",
email: "member@test.com",
name: "Member",
avatarUrl: null,
roles: [],
};
const provide = (auth: typeof adminAuth, workosOverrides: StubOverrides = {}) =>
Layer.mergeAll(Layer.succeed(AuthContext)(auth), stubWorkOS(workosOverrides));
// Mirrors `org/handlers.ts` `requireAdmin`.
const requireAdmin = Effect.gen(function* () {
const auth = yield* AuthContext;
const workos = yield* WorkOSClient;
const current = yield* workos.getUserOrgMembership(auth.organizationId, auth.accountId);
if (!current || current.role?.slug !== "admin") {
return yield* new Forbidden();
}
});
const withCurrentMembership: StubOverrides = {
getUserOrgMembership: (_organizationId: string, userId: string) =>
Effect.succeed(
userId === "user_admin"
? { id: "mem_admin", userId, status: "active", role: { slug: "admin" } }
: { id: "mem_member", userId, status: "active", role: { slug: "member" } },
),
};
// Mirrors `org/handlers.ts` `assertDomainInSessionOrg`.
const assertDomainInSessionOrg = (domainId: string) =>
Effect.gen(function* () {
const auth = yield* AuthContext;
const workos = yield* WorkOSClient;
const domain = yield* workos
.getOrganizationDomain(domainId)
.pipe(Effect.catchCause(() => Effect.succeed(null)));
if (!domain || domain.organizationId !== auth.organizationId) {
return yield* new Forbidden();
}
});
describe("Org domain handlers", () => {
describe("requireAdmin", () => {
it.effect("passes for an admin caller", () =>
requireAdmin.pipe(Effect.provide(provide(adminAuth, withCurrentMembership))),
);
it.effect("rejects a non-admin caller with Forbidden", () =>
Effect.gen(function* () {
const error = yield* Effect.flip(requireAdmin);
expect(error).toBeInstanceOf(Forbidden);
}).pipe(Effect.provide(provide(memberAuth, withCurrentMembership))),
);
});
describe("assertDomainInSessionOrg", () => {
it.effect("passes when the domain belongs to the session org", () =>
assertDomainInSessionOrg("dom_1").pipe(
Effect.provide(
provide(adminAuth, {
getOrganizationDomain: () =>
Effect.succeed({ id: "dom_1", organizationId: "org_1", domain: "acme.test" }),
}),
),
),
);
it.effect("rejects a domain owned by a different org with Forbidden", () =>
Effect.gen(function* () {
const error = yield* Effect.flip(assertDomainInSessionOrg("dom_other"));
expect(error).toBeInstanceOf(Forbidden);
}).pipe(
Effect.provide(
provide(adminAuth, {
getOrganizationDomain: () =>
Effect.succeed({ id: "dom_other", organizationId: "org_2", domain: "evil.test" }),
}),
),
),
);
it.effect("rejects (Forbidden) when the domain lookup fails — never leaks existence", () =>
Effect.gen(function* () {
const error = yield* Effect.flip(assertDomainInSessionOrg("dom_missing"));
expect(error).toBeInstanceOf(Forbidden);
}).pipe(
Effect.provide(
provide(adminAuth, {
getOrganizationDomain: () => Effect.fail(new UnstubbedWorkOSMethod({ method: "boom" })),
}),
),
),
);
});
});