// Cloud-only: the WorkOS login → AuthKit → callback session contract, driven// over the wire against the real handlers (AuthKit is the emulator). The happy// path itself is what `newIdentity()` performs on every scenario — these// scenarios pin the EDGE guarantees around it: the CSRF state handshake, the// callback refusing forged/incomplete redirects, the sealed-session cookie// actually authorizing the session API, and logout dropping the cookie.import { expect } from "@effect/vitest";import { Effect, Encoding, Result, Schema } from "effect"; import { scenario } from "../src/scenario";import { Api, Target } from "../src/services"; /** First `Set-Cookie` header for `name`, as the raw header string. */const setCookieFor = (response: Response, name: string): string => {  for (const header of response.headers.getSetCookie()) {    if (header.startsWith(`${name}=`)) return header;  }  return "";}; // state = base64url(JSON { nonce, returnTo? }) — the app's login-state// envelope (apps/cloud/src/auth/login-state.ts).const decodeLoginState = Schema.decodeUnknownOption(  Schema.fromJsonString(    Schema.Struct({ nonce: Schema.String, returnTo: Schema.optional(Schema.String) }),  ),); scenario(  "Auth · login redirects to hosted AuthKit carrying a short-lived CSRF state cookie",  {},  Effect.gen(function* () {    // Gate: the REST API plane is mounted on this target.    yield* Api;    const target = yield* Target;     const response = yield* Effect.promise(() =>      fetch(new URL("/api/auth/login", target.baseUrl), { redirect: "manual" }),    );    expect(response.status, "login hands the browser to AuthKit").toBe(302);     const authorizeUrl = new URL(response.headers.get("location") ?? "");    const state = authorizeUrl.searchParams.get("state") ?? "";    // The nonce is the CSRF secret; returnTo (absent here, no query was    // passed) rides beside it.    const decoded = decodeLoginState(      Result.getOrElse(Encoding.decodeBase64UrlString(state), () => ""),    );    expect(decoded._tag, "the state decodes as our login-state envelope").toBe("Some");    expect(      decoded._tag === "Some" ? decoded.value.nonce : "",      "the state carries an unguessable CSRF nonce",    ).toMatch(/^[0-9a-f]{64}$/);    expect(      authorizeUrl.searchParams.get("redirect_uri"),      "AuthKit is told to come back to this deployment's callback",    ).toBe(new URL("/api/auth/callback", target.baseUrl).toString());     const stateCookie = setCookieFor(response, "wos-login-state");    expect(stateCookie, "the same state is pinned in a cookie for the callback").toContain(      `wos-login-state=${state}`,    );    expect(stateCookie, "the login state expires quickly").toContain("Max-Age=600");    expect(stateCookie, "the login state is not readable by page scripts").toContain("HttpOnly");  }),); scenario(  "Auth · the callback rejects forged or incomplete redirects without exchanging the code",  {},  Effect.gen(function* () {    // Gate: the REST API plane is mounted on this target.    yield* Api;    const target = yield* Target;     const callback = (search: string, cookie?: string) =>      Effect.promise(() =>        fetch(new URL(`/api/auth/callback${search}`, target.baseUrl), {          redirect: "manual",          ...(cookie ? { headers: { cookie } } : {}),        }),      );     // A state that matches no login-state cookie (no login ever started).    const noCookie = yield* callback("?code=attacker-code&state=attacker-state");    expect(noCookie.status, "a state with no matching login cookie is refused").toBe(400);    expect(      setCookieFor(noCookie, "wos-session"),      "no session is minted from the forged redirect",    ).toBe("");     // A state that contradicts the login-state cookie the browser holds.    const mismatched = yield* callback(      "?code=attacker-code&state=attacker-state",      "wos-login-state=0000000000000000000000000000000000000000000000000000000000000000",    );    expect(mismatched.status, "a state contradicting the login cookie is refused").toBe(400);    expect(      setCookieFor(mismatched, "wos-session"),      "no session is minted from the mismatched redirect",    ).toBe("");     // A redirect that never carried the authorization code at all.    const noCode = yield* callback("");    expect(noCode.status, "a callback without a code is refused").toBe(400);  }),); scenario(  "Auth · a completed login's session cookie authorizes the session API",  {},  Effect.gen(function* () {    // Gate: the REST API plane is mounted on this target.    yield* Api;    const target = yield* Target;     // newIdentity() IS the full product login (login → AuthKit → callback);    // its headers carry the genuine sealed-session cookie the callback set.    const identity = yield* target.newIdentity();     const response = yield* Effect.promise(() =>      fetch(new URL("/api/auth/me", target.baseUrl), { headers: identity.headers ?? {} }),    );    expect(response.status, "the sealed-session cookie is accepted").toBe(200);    const me = (yield* Effect.promise(() => response.json())) as {      user: { email: string };      organization: { id: string } | null;    };    expect(me.user.email, "the session belongs to the user who logged in").toBe(identity.label);    expect(me.organization?.id, "the session carries the active organization").toMatch(/^org_/);  }),); scenario(  "Auth · logout ends the AuthKit session upstream and tells the browser to drop the cookie",  {},  Effect.gen(function* () {    // Gate: the REST API plane is mounted on this target.    yield* Api;    const target = yield* Target;     const identity = yield* target.newIdentity();     const response = yield* Effect.promise(() =>      fetch(new URL("/api/auth/logout", target.baseUrl), {        method: "POST",        redirect: "manual",        headers: identity.headers ?? {},      }),    );    expect(response.status, "logout hands the browser to WorkOS").toBe(302);    const cleared = setCookieFor(response, "wos-session");    expect(cleared, "the session cookie is expired immediately").toContain("Max-Age=0");    expect(cleared, "the cookie value is wiped").toContain("wos-session=;");     // The destination is WorkOS's session-end endpoint carrying this    // session's id — without this hop the hosted AuthKit session survives    // and the next sign-in silently re-authenticates.    const logoutUrl = new URL(response.headers.get("location") ?? "");    expect(logoutUrl.pathname, "the destination ends the WorkOS session").toBe(      "/user_management/sessions/logout",    );    expect(      logoutUrl.searchParams.get("session_id"),      "the WorkOS session being ended is this identity's",    ).toMatch(/^session_/);     const upstream = yield* Effect.promise(() => fetch(logoutUrl, { redirect: "manual" }));    expect(upstream.status, "WorkOS ends the session and sends the user onward").toBe(302);    expect(      upstream.headers.get("location"),      "the sign-out return URL lands back on this deployment",    ).toBe(new URL("/", target.baseUrl).toString());  }),);