import { env } from "cloudflare:workers";import { beforeAll, describe, expect, it } from "@effect/vitest"; import { cloudFirstPartyOAuthClients } from "./execution-stack"; // The reviewed consumer scope boundary of the Executor-owned Google app.//// These assertions used to live in `e2e/scenarios/first-party-oauth.test.ts`,// read off `listClients`. The app is now `unlisted`, so it has no read surface// to introspect — the bundle is only observable on the config it is built from,// which is here. The e2e still owns the BEHAVIOUR the boundary produces (which// scopes an `oauth.start` requests, and that admin scopes are refused).const GOOGLE_SCOPE = (suffix: string) => `https://www.googleapis.com/auth/${suffix}`; describe("cloud first-party oauth clients", () => {  beforeAll(() => {    env.FIRST_PARTY_GOOGLE_CLIENT_ID = "test-google-client";    env.FIRST_PARTY_GOOGLE_CLIENT_SECRET = "test-google-secret";  });   const google = () => cloudFirstPartyOAuthClients().find((client) => client.name === "google");   it("declares the Google app but withholds it from every listing", () => {    const client = google();    expect(client, "the env-declared first-party Google app is configured").toBeDefined();    // The entry MUST stay declared: `loadClient` resolves it by slug for every    // existing connection's refresh and reconnect. `unlisted` is what stops it    // being offered for new connections.    expect(client?.unlisted).toBe(true);  });   it("covers the reviewed consumer bundle", () => {    const allowed = google()?.allowedScopes;    expect(allowed).toBeDefined();    for (const scope of [      "calendar",      "meetings.space.readonly",      "spreadsheets",      "drive.file",      "drive",      "documents",      "presentations",      "forms.body",      "forms.responses.readonly",      "tasks",      "contacts",      "contacts.other.readonly",      "directory.readonly",      "user.addresses.read",      "user.birthday.read",      "user.emails.read",      "user.gender.read",      "user.organization.read",      "user.phonenumbers.read",      "photoslibrary.appendonly",      "photoslibrary.edit.appcreateddata",      "photospicker.mediaitems.readonly",      "webmasters",      "gmail.settings.basic",    ]) {      expect(allowed).toContain(GOOGLE_SCOPE(scope));    }    // `gmail.modify` stays in the host-enforced allowlist on purpose: a    // connection created before the full-Gmail review still declares it, and    // `resolveFirstPartyScopes` filters discovered scopes through this list, so    // dropping it would break those reconnects — as the legacy-spec case in the    // e2e asserts. The invariant that new Gmail presets request    // `mail.google.com` instead lives in the preset unit tests    // (packages/plugins/openapi/.../presets.test.ts), which is where the    // request-side scope choice is actually decided.    expect(allowed).toContain("https://mail.google.com/");    expect(allowed).toContain(GOOGLE_SCOPE("gmail.modify"));  });   it("excludes the scopes held back from consumer review", () => {    const allowed = google()?.allowedScopes;    expect(allowed).toBeDefined();    for (const scope of [      "gmail.settings.sharing",      "admin.directory.user",      "youtube",      "cloud-platform",    ]) {      expect(allowed).not.toContain(GOOGLE_SCOPE(scope));    }  });});