import { describe, expect, it } from "@effect/vitest";import * as Exit from "effect/Exit";import { OAuthStartError } from "@executor-js/sdk/shared"; import {  adminBlockFrom,  adminBlockFromExit,  adminBlockReference,  workIdentityLinkRequiredFromExit,} from "./oauth-admin-block"; // The claim these tests defend is a product claim, not a parsing one: a console// may only withdraw the interactive route when the identity provider actually// refused under policy. Reading it wrong in one direction strands a user with a// recoverable error and no retry; in the other, it walks them around the exact// control the enterprise just exercised. const denial = new OAuthStartError({  message: "Your organization does not permit this server.",  blockedByAdmin: true,  oauthErrorCode: "invalid_target",}); describe("adminBlockFrom", () => {  it("reads the verdict off the typed field", () => {    expect(adminBlockFrom(denial)).toEqual({      message: "Your organization does not permit this server.",      oauthErrorCode: "invalid_target",    });  });   it("carries a null reference when the provider returned no code", () => {    expect(      adminBlockFrom(new OAuthStartError({ message: "Refused.", blockedByAdmin: true }))        ?.oauthErrorCode,    ).toBeNull();  });   it("leaves an ordinary start failure alone", () => {    // No verdict means the interactive route stays open — an expired app, a    // bad endpoint, a network fault are all things a retry can fix.    expect(      adminBlockFrom(new OAuthStartError({ message: "Failed to reach the token endpoint." })),    ).toBeNull();  });   it("does not treat an explicitly-false verdict as a denial", () => {    expect(      adminBlockFrom(new OAuthStartError({ message: "Refused.", blockedByAdmin: false })),    ).toBeNull();  });   it("never infers a denial from the wording of a message", () => {    // The whole reason the field exists. A message that says the words is    // still not a verdict, and a console that matched on text would start    // withdrawing the retry for failures the user could have recovered from.    expect(      adminBlockFrom(        new OAuthStartError({ message: "blocked by admin: your organization declined" }),      ),    ).toBeNull();  });   it("finds the verdict through the popup flow's one level of wrapping", () => {    // `openAuthorization` rejects with its own error carrying the server's    // failure as `cause`; the verdict has to survive that hop or the modal    // sees only a sentence.    expect(adminBlockFrom({ message: "Failed to start sign-in", cause: denial })).toEqual({      message: "Your organization does not permit this server.",      oauthErrorCode: "invalid_target",    });  });   it("does not go hunting down a cause chain", () => {    // One level is the contract. A chain is not a search space: something    // deeper is not this connect's verdict.    expect(adminBlockFrom({ cause: { cause: denial } })).toBeNull();  });   it("reads nothing out of values that are not start failures", () => {    expect(adminBlockFrom(null)).toBeNull();    expect(adminBlockFrom("blocked")).toBeNull();    expect(adminBlockFrom({ blockedByAdmin: true })).toBeNull();  });}); describe("adminBlockFromExit", () => {  it("reads the verdict out of a failed exit", () => {    expect(adminBlockFromExit(Exit.fail(denial))?.oauthErrorCode).toBe("invalid_target");  });   it("has no verdict for a successful exit", () => {    expect(adminBlockFromExit(Exit.succeed({ status: "connected" }))).toBeNull();  });}); describe("workIdentityLinkRequiredFromExit", () => {  const unlinked = new OAuthStartError({    message: "No work identity is linked for this identity provider.",    workIdentityLinkRequired: true,  });   it("reads the remedy off the typed field", () => {    expect(workIdentityLinkRequiredFromExit(Exit.fail(unlinked))).toBe(true);  });   it("survives the popup flow's one level of wrapping", () => {    expect(      workIdentityLinkRequiredFromExit(        Exit.fail({ message: "Failed to start sign-in", cause: unlinked }),      ),    ).toBe(true);  });   it("is not asked for by an administrator denial", () => {    // The two verdicts are disjoint upstream, and the console must keep them    // that way: opening a sign-in against a client the identity provider has    // denied spends the member's time to reach the same refusal.    expect(workIdentityLinkRequiredFromExit(Exit.fail(denial))).toBe(false);  });   it("is not inferred from an ordinary failure", () => {    expect(      workIdentityLinkRequiredFromExit(        Exit.fail(new OAuthStartError({ message: "Token endpoint 502." })),      ),    ).toBe(false);  });   it("is false for a successful start", () => {    expect(workIdentityLinkRequiredFromExit(Exit.succeed({ status: "connected" }))).toBe(false);  });}); describe("adminBlockReference", () => {  it("quotes the provider's own code so a member can trace it", () => {    expect(adminBlockReference({ message: "…", oauthErrorCode: "invalid_target" })).toBe(      "Reference: invalid_target",    );  });   it("shows no reference line when there is no code to show", () => {    expect(adminBlockReference({ message: "…", oauthErrorCode: null })).toBeNull();  });});