import { mkdtempSync } from "node:fs";import { tmpdir } from "node:os";import { join } from "node:path"; import { afterAll, expect, test } from "@effect/vitest";import { connectionIdentifier } from "@executor-js/sdk/shared"; process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-iso-")); // Identity comes from request headers so a single handler can serve many// distinct identities concurrently — the setup that would expose a cross-fiber// identity leak if the per-request executor's binding were shared rather than// request-scoped. Each identity is its own (org, user): in v2 the org is the// tenant (catalog partition) and the user is the acting subject (drives// `owner: "user"` rows).const { makeSelfHostTestApp, headerIdentityLayer } = await import("./testing/test-app"); const { handler, dispose } = await makeSelfHostTestApp({ identity: headerIdentityLayer,});afterAll(() => dispose()); const TINY_SPEC = JSON.stringify({ openapi: "3.0.0", info: { title: "Tiny", version: "1.0.0" }, servers: [{ url: "https://httpbin.org" }], paths: { "/get": { get: { operationId: "httpGet", summary: "GET", responses: { "200": { description: "ok" } }, }, }, },}); const headersFor = (userId: string, organizationId: string): Record<string, string> => ({ "x-test-user": userId, "x-test-org": organizationId, "content-type": "application/json",}); const connectionNameForUser = (userId: string): string => String(connectionIdentifier(`conn-${userId}`)); // Seed, as the given identity, a tenant-scoped integration plus a user-owned// connection named after the subject. Tenant isolation means each identity's// catalog is independent; subject isolation means the user connection is private.const seedIdentity = async (userId: string, organizationId: string): Promise<void> => { const headers = headersFor(userId, organizationId); const add = await handler( new Request("http://localhost/api/openapi/specs", { method: "POST", headers, body: JSON.stringify({ spec: { kind: "blob", value: TINY_SPEC }, slug: "iso", baseUrl: "", }), }), ); expect(add.status).toBe(200); const conn = await handler( new Request("http://localhost/api/connections", { method: "POST", headers, body: JSON.stringify({ owner: "user", name: `conn-${userId}`, integration: "iso", template: "bearer", value: `token-${userId}`, }), }), ); expect(conn.status).toBe(200);}; const listConnectionAddresses = async ( userId: string, organizationId: string,): Promise<{ status: number; addresses: string[] }> => { const res = await handler( new Request("http://localhost/api/connections", { headers: { "x-test-user": userId, "x-test-org": organizationId }, }), ); if (res.status !== 200) return { status: res.status, addresses: [] }; const body = (await res.json()) as ReadonlyArray<{ address: string }>; return { status: res.status, addresses: body.map((c) => c.address) };}; test("concurrent requests with distinct identities get disjoint, correct executor bindings", async () => { // 6 identities, each its own (org, user). Seed each sequentially, then read // them back over the one long-lived SQLite handle with all 6 distinct // identities in flight at once, repeated across rounds. // // The leak this guards against is a logic bug (a shared rather than // request-scoped binding), so it surfaces whenever distinct identities are // concurrent at all; 6 simultaneous is plenty. We deliberately bound // in-flight requests to those 6 instead of firing an unbounded 48-wide burst: // every query serializes through the single libSQL connection, so a 48-fiber // pile-up starves the event loop under CI load and times out (the flake this // test was hitting). Same 48 total reads, same assertions, bounded pressure. const identities = Array.from({ length: 6 }, (_, i) => ({ userId: `user-${i}`, organizationId: `org-${i}`, })); for (const id of identities) { await seedIdentity(id.userId, id.organizationId); } const rounds = 8; const observed: Array<{ userId: string; status: number; addresses: string[] }> = []; for (let round = 0; round < rounds; round++) { const roundResults = await Promise.all( identities.map(async (id) => ({ userId: id.userId, ...(await listConnectionAddresses(id.userId, id.organizationId)), })), ); observed.push(...roundResults); } expect(observed).toHaveLength(rounds * identities.length); observed.forEach(({ userId, status, addresses }) => { // Each response reflects ONLY its own request's identity — no bleed. The // subject's own user connection is present, and no OTHER subject's is. expect(status).toBe(200); expect(addresses.some((a) => a.includes(connectionNameForUser(userId)))).toBe(true); const otherUsers = identities.map((id) => id.userId).filter((u) => u !== userId); for (const other of otherUsers) { expect(addresses.some((a) => a.includes(connectionNameForUser(other)))).toBe(false); } });}, 30_000); test("a request with no identity is rejected", async () => { const res = await handler(new Request("http://localhost/api/connections")); // The header provider returns no principal -> the middleware's unauthenticated // path fires. expect(res.status).toBeGreaterThanOrEqual(400);});
import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { afterAll, expect, test } from "@effect/vitest";
import { connectionIdentifier } from "@executor-js/sdk/shared";
process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-iso-"));
// Identity comes from request headers so a single handler can serve many
// distinct identities concurrently — the setup that would expose a cross-fiber
// identity leak if the per-request executor's binding were shared rather than
// request-scoped. Each identity is its own (org, user): in v2 the org is the
// tenant (catalog partition) and the user is the acting subject (drives
// `owner: "user"` rows).
const { makeSelfHostTestApp, headerIdentityLayer } = await import("./testing/test-app");
const { handler, dispose } = await makeSelfHostTestApp({
identity: headerIdentityLayer,
});
afterAll(() => dispose());
const TINY_SPEC = JSON.stringify({
openapi: "3.0.0",
info: { title: "Tiny", version: "1.0.0" },
servers: [{ url: "https://httpbin.org" }],
paths: {
"/get": {
get: {
operationId: "httpGet",
summary: "GET",
responses: { "200": { description: "ok" } },
},
},
},
});
const headersFor = (userId: string, organizationId: string): Record<string, string> => ({
"x-test-user": userId,
"x-test-org": organizationId,
"content-type": "application/json",
});
const connectionNameForUser = (userId: string): string =>
String(connectionIdentifier(`conn-${userId}`));
// Seed, as the given identity, a tenant-scoped integration plus a user-owned
// connection named after the subject. Tenant isolation means each identity's
// catalog is independent; subject isolation means the user connection is private.
const seedIdentity = async (userId: string, organizationId: string): Promise<void> => {
const headers = headersFor(userId, organizationId);
const add = await handler(
new Request("http://localhost/api/openapi/specs", {
method: "POST",
headers,
body: JSON.stringify({
spec: { kind: "blob", value: TINY_SPEC },
slug: "iso",
baseUrl: "",
}),
}),
);
expect(add.status).toBe(200);
const conn = await handler(
new Request("http://localhost/api/connections", {
method: "POST",
headers,
body: JSON.stringify({
owner: "user",
name: `conn-${userId}`,
integration: "iso",
template: "bearer",
value: `token-${userId}`,
}),
}),
);
expect(conn.status).toBe(200);
};
const listConnectionAddresses = async (
userId: string,
organizationId: string,
): Promise<{ status: number; addresses: string[] }> => {
const res = await handler(
new Request("http://localhost/api/connections", {
headers: { "x-test-user": userId, "x-test-org": organizationId },
}),
);
if (res.status !== 200) return { status: res.status, addresses: [] };
const body = (await res.json()) as ReadonlyArray<{ address: string }>;
return { status: res.status, addresses: body.map((c) => c.address) };
};
test("concurrent requests with distinct identities get disjoint, correct executor bindings", async () => {
// 6 identities, each its own (org, user). Seed each sequentially, then read
// them back over the one long-lived SQLite handle with all 6 distinct
// identities in flight at once, repeated across rounds.
//
// The leak this guards against is a logic bug (a shared rather than
// request-scoped binding), so it surfaces whenever distinct identities are
// concurrent at all; 6 simultaneous is plenty. We deliberately bound
// in-flight requests to those 6 instead of firing an unbounded 48-wide burst:
// every query serializes through the single libSQL connection, so a 48-fiber
// pile-up starves the event loop under CI load and times out (the flake this
// test was hitting). Same 48 total reads, same assertions, bounded pressure.
const identities = Array.from({ length: 6 }, (_, i) => ({
userId: `user-${i}`,
organizationId: `org-${i}`,
}));
for (const id of identities) {
await seedIdentity(id.userId, id.organizationId);
}
const rounds = 8;
const observed: Array<{ userId: string; status: number; addresses: string[] }> = [];
for (let round = 0; round < rounds; round++) {
const roundResults = await Promise.all(
identities.map(async (id) => ({
userId: id.userId,
...(await listConnectionAddresses(id.userId, id.organizationId)),
})),
);
observed.push(...roundResults);
}
expect(observed).toHaveLength(rounds * identities.length);
observed.forEach(({ userId, status, addresses }) => {
// Each response reflects ONLY its own request's identity — no bleed. The
// subject's own user connection is present, and no OTHER subject's is.
expect(status).toBe(200);
expect(addresses.some((a) => a.includes(connectionNameForUser(userId)))).toBe(true);
const otherUsers = identities.map((id) => id.userId).filter((u) => u !== userId);
for (const other of otherUsers) {
expect(addresses.some((a) => a.includes(connectionNameForUser(other)))).toBe(false);
}
});
}, 30_000);
test("a request with no identity is rejected", async () => {
const res = await handler(new Request("http://localhost/api/connections"));
// The header provider returns no principal -> the middleware's unauthenticated
// path fires.
expect(res.status).toBeGreaterThanOrEqual(400);
});