import { describe, expect, it } from "@effect/vitest";import {  AuthTemplateSlug,  IntegrationSlug,  OAuthClientSlug,  type OAuthClientSummary,} from "@executor-js/sdk/shared"; import { enterpriseConnectPlan, selectEnterpriseClient } from "./enterprise-connect";import type { AuthMethod } from "./auth-placements"; const INTEGRATION = IntegrationSlug.make("acme_mcp");const ENDPOINT = "https://mcp.acme.test/mcp";const IDP = {  client: OAuthClientSlug.make("enterprise-identity-provider"),  clientOwner: "org",} as const; const client = (overrides: Partial<OAuthClientSummary> = {}): OAuthClientSummary => ({  owner: "org",  slug: OAuthClientSlug.make("acme-enterprise"),  grant: "id_jag",  authorizationUrl: "https://mcp.acme.test/authorize",  tokenUrl: "https://mcp.acme.test/token",  resource: ENDPOINT,  clientId: "client-id",  origin: { kind: "manual" },  ...overrides,}); const oauthMethod = (oauth: AuthMethod["oauth"]): AuthMethod => ({  id: "oauth2",  label: "OAuth",  kind: "oauth",  source: "spec",  template: AuthTemplateSlug.make("oauth2"),  placements: [],  oauth,}); const managedMethod = oauthMethod({  discoveryUrl: ENDPOINT,  supportsDynamicRegistration: true,  enterpriseIdentityProvider: IDP,}); describe("selectEnterpriseClient", () => {  it("matches the app registered against this server's resource", () => {    expect(      selectEnterpriseClient([client()], {        integration: INTEGRATION,        resource: ENDPOINT,      })?.slug,    ).toBe(client().slug);  });   it("matches an app registered from this integration's own dialog", () => {    // Recorded intent outranks everything: the administrator built it here.    const intent = client({      slug: OAuthClientSlug.make("by-intent"),      resource: null,      authorizationUrl: "https://elsewhere.test/authorize",      tokenUrl: "https://elsewhere.test/token",      origin: { kind: "manual", integration: INTEGRATION },    });    expect(      selectEnterpriseClient([client(), intent], {        integration: INTEGRATION,        resource: ENDPOINT,      })?.slug,    ).toBe(intent.slug);  });   it("ignores every grant but id_jag", () => {    // An ordinary interactive app on the same server is not an enterprise    // registration, and presenting an assertion through it would fail.    expect(      selectEnterpriseClient([client({ grant: "authorization_code" })], {        integration: INTEGRATION,        resource: ENDPOINT,      }),    ).toBeNull();  });   it("refuses an id_jag app registered for a DIFFERENT server", () => {    // Not a degraded match: an ID-JAG is audienced to one resource authorization    // server, so the wrong app is the wrong server.    expect(      selectEnterpriseClient(        [          client({            resource: "https://other.test/mcp",            authorizationUrl: "https://other.test/authorize",            tokenUrl: "https://other.test/token",          }),        ],        { integration: INTEGRATION, resource: ENDPOINT },      ),    ).toBeNull();  });   it("prefers the organization's app when two match equally", () => {    const personal = client({      owner: "user",      slug: OAuthClientSlug.make("aaa-personal"),    });    expect(      selectEnterpriseClient([personal, client()], {        integration: INTEGRATION,        resource: ENDPOINT,      })?.owner,    ).toBe("org");  });}); describe("enterpriseConnectPlan", () => {  it("leaves an undeclared server on today's routes", () => {    expect(      enterpriseConnectPlan({        method: oauthMethod({          discoveryUrl: ENDPOINT,          supportsDynamicRegistration: true,        }),        integration: INTEGRATION,        clients: [client()],      }),    ).toEqual({ kind: "unmanaged" });  });   it("takes the enterprise route when declared AND registered", () => {    const plan = enterpriseConnectPlan({      method: managedMethod,      integration: INTEGRATION,      clients: [client()],    });    expect(plan.kind).toBe("enterprise");    // The pointer travels verbatim: `oauth.start` has to name THIS registration.    expect(plan.kind === "enterprise" ? plan.identityProvider : null).toEqual(IDP);  });   it("reports the gap rather than silently taking DCR when no id_jag app exists", () => {    // The bug this module exists to prevent: a declared-managed server whose    // enterprise app was never registered used to register a fresh    // authorization_code client and ask the member for per-server consent, with    // nothing on screen saying the declaration had been bypassed.    expect(      enterpriseConnectPlan({        method: managedMethod,        integration: INTEGRATION,        clients: [],      }),    ).toEqual({ kind: "unregistered", identityProvider: IDP });  });   it("does not treat a registered id_jag app as a declaration on its own", () => {    // Registering the app is an administrator preparing the server; declaring it    // managed is the decision that members stop consenting. Only the second one    // may change what a member is offered.    expect(      enterpriseConnectPlan({        method: oauthMethod({ discoveryUrl: ENDPOINT }),        integration: INTEGRATION,        clients: [client()],      }).kind,    ).toBe("unmanaged");  });   it("leaves a credential method alone", () => {    expect(      enterpriseConnectPlan({        method: {          id: "apikey",          label: "API key",          kind: "apikey",          source: "spec",          template: AuthTemplateSlug.make("apikey"),          placements: [],        },        integration: INTEGRATION,        clients: [client()],      }).kind,    ).toBe("unmanaged");  });});