// Self-host: the CLI `executor login` device-authorization flow end to end// against the self-host app (Better Auth), terminal AND browser, both recorded.// The `executor` binary runs RFC 8628 in a real terminal (terminal.cast): it// discovers Better Auth's device endpoints via /api/auth/cli-login, prints the// verification URL, and polls. The browser leg is REAL (session.mp4): Playwright// opens the self-host /device page (signed in via the session cookie) and clicks// "Authorize device". The terminal then runs `whoami` and `tools sources`; a// clean exit of that chain proves the Better Auth device token is accepted as a// Bearer on the protected /api/* plane.import { readFileSync } from "node:fs";import { dirname, join, resolve } from "node:path";import { fileURLToPath } from "node:url"; import { expect } from "@effect/vitest";import { Effect } from "effect"; import { scenario } from "../src/scenario";import { Browser, Cli, RunDir, Target } from "../src/services";import { enterFocus } from "../src/timeline";import { SELFHOST_BASE_URL } from "../targets/selfhost"; const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");const CLI_ENTRY = join(REPO_ROOT, "apps", "cli", "src", "main.ts"); scenario(  "CLI · executor login device flow → authenticated /api call",  { timeout: 180_000 },  Effect.scoped(    Effect.gen(function* () {      const target = yield* Target;      if (target.name !== "selfhost") return;       // Slow + hold the browser steps so the recording is watchable. Scoped to      // this scenario and restored after (files run serially, so a leaked flag      // would slow every later scenario).      const prevFilm = process.env.E2E_FILM;      yield* Effect.addFinalizer(() =>        Effect.sync(() => {          if (prevFilm === undefined) delete process.env.E2E_FILM;          else process.env.E2E_FILM = prevFilm;        }),      );      process.env.E2E_FILM = "1";       const cli = yield* Cli;      const browser = yield* Browser;      const runDir = yield* RunDir;      const dataDir = join(runDir, "cli-home");       // A signed-in identity (its session cookie authorizes the /device page).      const identity = yield* target.newIdentity();       const env = { ...process.env, EXECUTOR_DATA_DIR: dataDir };      for (const key of ["EXECUTOR_API_KEY", "EXECUTOR_AUTH_TOKEN", "EXECUTOR_AUTH_PASSWORD"]) {        delete (env as Record<string, string | undefined>)[key];      }       let resolveUrl!: (url: string) => void;      const verificationUrl = new Promise<string>((r) => {        resolveUrl = r;      });       const cli_ = `bun run ${CLI_ENTRY}`;      const journey =        `${cli_} login --base-url ${SELFHOST_BASE_URL} --no-browser --name selfhost && ` +        `${cli_} whoami --server selfhost && ` +        `${cli_} tools sources --server selfhost`;       const terminal = cli.session(        ["bash", "-c", journey],        async (session) => {          await session.screen.waitForText(/user_code=/, { timeoutMs: 60_000 });          const match = (await session.screen.text()).match(/(https?:\/\/\S*user_code=\S+)/);          if (!match) throw new Error("verification URL not found on screen");          resolveUrl(match[1]);          await session.screen.waitForText("Logged in to", { timeoutMs: 60_000 });          const exit = await session.waitForExit({ timeoutMs: 60_000 });          if (exit.reason !== "exited" || exit.exit.code !== 0) {            throw new Error(              `journey did not exit cleanly: ${JSON.stringify(exit)}\n${await session.screen.text()}`,            );          }          return session.screen.text();        },        {          cwd: REPO_ROOT,          env,          record: join(runDir, "terminal.cast"),          viewport: { cols: 300, rows: 48 },        },      );       // The browser leg, approve on the self-host /device page (session cookie      // from the identity authorizes it). Recorded to session.mp4.      const browserApproval = Effect.gen(function* () {        const url = yield* Effect.promise(() => verificationUrl);        yield* browser.session(identity, async ({ page, step }) => {          await step("Open the device verification page", async () => {            await page.goto(url, { waitUntil: "domcontentloaded" });            // The Authorize button appears once the page binds the signed-in user.            await page              .getByRole("button", { name: /Authorize device/i })              .waitFor({ timeout: 20_000 });          });          await step("Authorize the device", async () => {            await page.getByRole("button", { name: /Authorize device/i }).click();            await page.getByText(/Device approved/i).waitFor({ timeout: 15_000 });          });        });        // Cut the synced player back to the terminal for the "Logged in" + the        // authenticated /api call that follow the browser approval.        yield* Effect.promise(() => enterFocus(runDir, "terminal"));      });       // Reaching here means the whole `&&` chain exited 0, including the      // authenticated `tools sources` /api call.      yield* Effect.all([terminal, browserApproval], { concurrency: "unbounded" });       // The stored profile carries an oauth device-login credential, not a key.      const store = JSON.parse(readFileSync(join(dataDir, "server-connections.json"), "utf8")) as {        defaultProfile: string | null;        profiles: Array<{          name: string;          connection: { auth?: { kind: string; accessToken?: string } };        }>;      };      expect(store.defaultProfile, "the login became the default profile").toBe("selfhost");      const profile = store.profiles.find((p) => p.name === "selfhost");      expect(profile?.connection.auth?.kind, "credential is an oauth device token").toBe("oauth");      expect(typeof profile?.connection.auth?.accessToken, "an access token is stored").toBe(        "string",      );    }),  ),);