// The cloud app as a target: its real dev server with the real WorkOS and// Autumn SDKs pointed at emulators (WORKOS_API_URL / AUTUMN_API_URL — see// setup/cloud.globalsetup.ts). Identities are minted through the REAL login// flow: /api/auth/login → emulator hosted AuthKit (headless via login_hint) →// /api/auth/callback → genuine sealed-session cookie. Isolation: every// identity is a fresh user (and org) — no resets.import { randomUUID } from "node:crypto"; import { Effect } from "effect"; import { connectEmulator } from "@executor-js/emulate"; import { e2ePort } from "../src/ports";import type { Identity, Target } from "../src/target"; export const CLOUD_PORT = e2ePort("E2E_CLOUD_PORT", 0);export const CLOUD_DB_PORT = e2ePort("E2E_CLOUD_DB_PORT", 1);export const CLOUD_BASE_URL = process.env.E2E_CLOUD_URL ?? `http://127.0.0.1:${CLOUD_PORT}`;export const WORKOS_EMULATOR_PORT = e2ePort("E2E_WORKOS_EMULATOR_PORT", 2);export const AUTUMN_EMULATOR_PORT = e2ePort("E2E_AUTUMN_EMULATOR_PORT", 3);export const E2E_WORKOS_CLIENT_ID = "client_e2e_emulate";export const E2E_COOKIE_PASSWORD = "e2e_cookie_password_0123456789abcdef0123456789abcdef"; const cookiePair = (response: Response, name: string): string | undefined => { for (const header of response.headers.getSetCookie?.() ?? []) { if (header.startsWith(`${name}=`)) return header.split(";")[0]; } return undefined;}; /** The real product login, headless: login → hosted AuthKit → callback. */const signIn = async (email: string): Promise<string> => { const login = await fetch(new URL("/api/auth/login", CLOUD_BASE_URL), { redirect: "manual" }); const stateCookie = cookiePair(login, "wos-login-state"); const authorizeUrl = new URL(login.headers.get("location") ?? ""); if (!stateCookie || !authorizeUrl.searchParams.get("state")) { throw new Error(`cloud signIn: login did not redirect to AuthKit (${login.status})`); } // The emulator's hosted login signs in headlessly via login_hint (creating // the user if new) and redirects back with a code. authorizeUrl.searchParams.set("login_hint", email); const consent = await fetch(authorizeUrl, { redirect: "manual" }); const callbackUrl = consent.headers.get("location"); if (consent.status !== 302 || !callbackUrl) { throw new Error(`cloud signIn: AuthKit emulator did not redirect (${consent.status})`); } const callback = await fetch(callbackUrl, { redirect: "manual", headers: { cookie: stateCookie }, }); const session = cookiePair(callback, "wos-session"); if (!session) throw new Error(`cloud signIn: callback set no session (${callback.status})`); return session; // "wos-session=<sealed>"}; export const cloudTarget = (): Target => ({ name: "cloud", baseUrl: CLOUD_BASE_URL, mcpUrl: `${CLOUD_BASE_URL}/mcp`, capabilities: new Set(["api", "browser", "billing", "mcp-oauth"]), // Cloud's authorization server is the WorkOS emulator, so token-expiry // scenarios can compress the lifecycle (the TtlControl service). setAccessTokenTtl: (seconds) => Effect.promise(async () => { const workos = await connectEmulator({ baseUrl: `http://127.0.0.1:${WORKOS_EMULATOR_PORT}`, }); await workos.seed({ oauth: { default_access_token_ttl_seconds: seconds } }); }), newIdentity: ({ org = true } = {}) => Effect.promise(async (): Promise<Identity> => { const label = `user-${randomUUID().slice(0, 8)}`; const email = `${label}@e2e.test`; let session = await signIn(email); if (org) { // The real create-organization flow; the refreshed sealed session in // the response carries the new org. const response = await fetch(new URL("/api/auth/create-organization", CLOUD_BASE_URL), { method: "POST", headers: { "content-type": "application/json", origin: new URL(CLOUD_BASE_URL).origin, cookie: session, }, body: JSON.stringify({ name: `Org ${label}` }), }); if (!response.ok) { throw new Error(`cloud newIdentity: create-organization failed (${response.status})`); } session = cookiePair(response, "wos-session") ?? session; } const [name, value] = session.split(/=(.*)/s); return { label: email, headers: { cookie: session }, cookies: [{ name: name!, value: value! }], credentials: { email, password: "emulated" }, }; }), // MCP OAuth against the emulator's authorization server: complete the // hosted flow headlessly as this identity. mcpConsent: (identity) => async (request) => { const authorizeUrl = new URL(request.authorizationUrl); authorizeUrl.searchParams.set("login_hint", identity.credentials?.email ?? "mcp@e2e.test"); const response = await fetch(authorizeUrl, { redirect: "manual" }); const location = response.headers.get("location"); if (response.status !== 302 || !location) { throw new Error(`cloud mcpConsent: authorize did not redirect (${response.status})`); } const code = new URL(location).searchParams.get("code"); if (!code) throw new Error("cloud mcpConsent: no code in redirect"); return { code }; },});
// The cloud app as a target: its real dev server with the real WorkOS and
// Autumn SDKs pointed at emulators (WORKOS_API_URL / AUTUMN_API_URL — see
// setup/cloud.globalsetup.ts). Identities are minted through the REAL login
// flow: /api/auth/login → emulator hosted AuthKit (headless via login_hint) →
// /api/auth/callback → genuine sealed-session cookie. Isolation: every
// identity is a fresh user (and org) — no resets.
import { randomUUID } from "node:crypto";
import { Effect } from "effect";
import { connectEmulator } from "@executor-js/emulate";
import { e2ePort } from "../src/ports";
import type { Identity, Target } from "../src/target";
export const CLOUD_PORT = e2ePort("E2E_CLOUD_PORT", 0);
export const CLOUD_DB_PORT = e2ePort("E2E_CLOUD_DB_PORT", 1);
export const CLOUD_BASE_URL = process.env.E2E_CLOUD_URL ?? `http://127.0.0.1:${CLOUD_PORT}`;
export const WORKOS_EMULATOR_PORT = e2ePort("E2E_WORKOS_EMULATOR_PORT", 2);
export const AUTUMN_EMULATOR_PORT = e2ePort("E2E_AUTUMN_EMULATOR_PORT", 3);
export const E2E_WORKOS_CLIENT_ID = "client_e2e_emulate";
export const E2E_COOKIE_PASSWORD = "e2e_cookie_password_0123456789abcdef0123456789abcdef";
const cookiePair = (response: Response, name: string): string | undefined => {
for (const header of response.headers.getSetCookie?.() ?? []) {
if (header.startsWith(`${name}=`)) return header.split(";")[0];
}
return undefined;
};
/** The real product login, headless: login → hosted AuthKit → callback. */
const signIn = async (email: string): Promise<string> => {
const login = await fetch(new URL("/api/auth/login", CLOUD_BASE_URL), { redirect: "manual" });
const stateCookie = cookiePair(login, "wos-login-state");
const authorizeUrl = new URL(login.headers.get("location") ?? "");
if (!stateCookie || !authorizeUrl.searchParams.get("state")) {
throw new Error(`cloud signIn: login did not redirect to AuthKit (${login.status})`);
}
// The emulator's hosted login signs in headlessly via login_hint (creating
// the user if new) and redirects back with a code.
authorizeUrl.searchParams.set("login_hint", email);
const consent = await fetch(authorizeUrl, { redirect: "manual" });
const callbackUrl = consent.headers.get("location");
if (consent.status !== 302 || !callbackUrl) {
throw new Error(`cloud signIn: AuthKit emulator did not redirect (${consent.status})`);
}
const callback = await fetch(callbackUrl, {
redirect: "manual",
headers: { cookie: stateCookie },
});
const session = cookiePair(callback, "wos-session");
if (!session) throw new Error(`cloud signIn: callback set no session (${callback.status})`);
return session; // "wos-session=<sealed>"
};
export const cloudTarget = (): Target => ({
name: "cloud",
baseUrl: CLOUD_BASE_URL,
mcpUrl: `${CLOUD_BASE_URL}/mcp`,
capabilities: new Set(["api", "browser", "billing", "mcp-oauth"]),
// Cloud's authorization server is the WorkOS emulator, so token-expiry
// scenarios can compress the lifecycle (the TtlControl service).
setAccessTokenTtl: (seconds) =>
Effect.promise(async () => {
const workos = await connectEmulator({
baseUrl: `http://127.0.0.1:${WORKOS_EMULATOR_PORT}`,
});
await workos.seed({ oauth: { default_access_token_ttl_seconds: seconds } });
}),
newIdentity: ({ org = true } = {}) =>
Effect.promise(async (): Promise<Identity> => {
const label = `user-${randomUUID().slice(0, 8)}`;
const email = `${label}@e2e.test`;
let session = await signIn(email);
if (org) {
// The real create-organization flow; the refreshed sealed session in
// the response carries the new org.
const response = await fetch(new URL("/api/auth/create-organization", CLOUD_BASE_URL), {
method: "POST",
headers: {
"content-type": "application/json",
origin: new URL(CLOUD_BASE_URL).origin,
cookie: session,
},
body: JSON.stringify({ name: `Org ${label}` }),
});
if (!response.ok) {
throw new Error(`cloud newIdentity: create-organization failed (${response.status})`);
}
session = cookiePair(response, "wos-session") ?? session;
}
const [name, value] = session.split(/=(.*)/s);
return {
label: email,
headers: { cookie: session },
cookies: [{ name: name!, value: value! }],
credentials: { email, password: "emulated" },
};
}),
// MCP OAuth against the emulator's authorization server: complete the
// hosted flow headlessly as this identity.
mcpConsent: (identity) => async (request) => {
const authorizeUrl = new URL(request.authorizationUrl);
authorizeUrl.searchParams.set("login_hint", identity.credentials?.email ?? "mcp@e2e.test");
const response = await fetch(authorizeUrl, { redirect: "manual" });
const location = response.headers.get("location");
if (response.status !== 302 || !location) {
throw new Error(`cloud mcpConsent: authorize did not redirect (${response.status})`);
}
const code = new URL(location).searchParams.get("code");
if (!code) throw new Error("cloud mcpConsent: no code in redirect");
return { code };
},
});