import { mkdtempSync } from "node:fs";import { tmpdir } from "node:os";import { join } from "node:path"; import { afterAll, describe, expect, it, test } from "@effect/vitest";import { createEmulator } from "@executor-js/emulate"; import { mintInviteCode } from "../testing/mint-invite"; // Real Better Auth path with an SSO provider configured — and a REAL IdP on the// wire: an @executor-js/emulate Okta instance serving OIDC discovery,// authorize, and token, so the round-trip tests below exercise the same// discovery -> redirect -> consent -> callback flow a production Google/Okta// deployment does. Emulator + registered client + env must all exist before// the app import, so `loadConfig` sees a fully-configured instance at boot.const BASE = "http://localhost:4788";const CALLBACK = `${BASE}/api/auth/oauth2/callback/okta`; const idp = await createEmulator({ service: "okta", port: 4790 });afterAll(() => idp.close()); const registration = await fetch(`${idp.url}/oauth2/v1/clients`, {  method: "POST",  headers: { "content-type": "application/json" },  body: JSON.stringify({    client_name: "executor-selfhost-test",    redirect_uris: [CALLBACK],    grant_types: ["authorization_code"],    response_types: ["code"],    token_endpoint_auth_method: "client_secret_post",  }),}).then((r) => r.json() as Promise<{ client_id: string; client_secret: string }>); const createIdpUser = (email: string, firstName: string) =>  fetch(`${idp.url}/api/v1/users`, {    method: "POST",    headers: { "content-type": "application/json", authorization: "SSWS test" },    body: JSON.stringify({ profile: { login: email, email, firstName, lastName: "User" } }),  });await createIdpUser("alice@example.com", "Alice");await createIdpUser("mallory@evil.test", "Mallory"); process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-sso-"));process.env.BETTER_AUTH_SECRET = "test-secret-0123456789-abcdefghijklmnop-qrstuv";process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@test.local";process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-password-123";process.env.EXECUTOR_SSO_PROVIDER_ID = "okta";process.env.EXECUTOR_SSO_DISCOVERY_URL = `${idp.url}/.well-known/openid-configuration`;process.env.EXECUTOR_SSO_CLIENT_ID = registration.client_id;process.env.EXECUTOR_SSO_CLIENT_SECRET = registration.client_secret;process.env.EXECUTOR_SSO_ALLOWED_DOMAINS = "Example.com, @second.example ,"; const { loadConfig } = await import("../config");const { emailDomain } = await import("./sso");const { makeSelfHostApiHandler } = await import("../app"); const { handler, dispose } = await makeSelfHostApiHandler();afterAll(() => dispose()); const SSO_ENV_KEYS = [  "EXECUTOR_SSO_PROVIDER_ID",  "EXECUTOR_SSO_PROVIDER_NAME",  "EXECUTOR_SSO_DISCOVERY_URL",  "EXECUTOR_SSO_CLIENT_ID",  "EXECUTOR_SSO_CLIENT_SECRET",  "EXECUTOR_SSO_ALLOWED_DOMAINS",] as const; // Run a block with the SSO env vars swapped out, restoring them afterwards so// the booted instance's request-time config reads stay consistent.const withSsoEnv = <T>(overrides: Record<string, string | undefined>, run: () => T): T => {  const saved = Object.fromEntries(SSO_ENV_KEYS.map((k) => [k, process.env[k]]));  for (const key of SSO_ENV_KEYS) {    const value = overrides[key];    if (value === undefined) delete process.env[key];    else process.env[key] = value;  }  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: env save/restore around config reads must restore on assertion failure  try {    return run();  } finally {    for (const key of SSO_ENV_KEYS) {      const value = saved[key];      if (value === undefined) delete process.env[key];      else process.env[key] = value;    }  }}; describe("sso config resolution", () => {  it("normalizes the domain allowlist (trim, lowercase, strip @, drop empties)", () => {    const sso = loadConfig().sso;    expect(sso).toBeDefined();    expect(sso!.allowedDomains).toEqual(["example.com", "second.example"]);  });   it("derives the display name from the provider id when not set", () => {    expect(loadConfig().sso!.providerName).toBe("Okta");  });   it("is undefined when no SSO env is set", () => {    withSsoEnv({}, () => {      expect(loadConfig().sso).toBeUndefined();    });  });   it("refuses half-configured credentials", () => {    withSsoEnv({ EXECUTOR_SSO_CLIENT_ID: "id-only" }, () => {      expect(() => loadConfig()).toThrow(/must be set together/);    });  });   it("refuses credentials without a provider id", () => {    withSsoEnv({ EXECUTOR_SSO_CLIENT_ID: "id", EXECUTOR_SSO_CLIENT_SECRET: "secret" }, () => {      expect(() => loadConfig()).toThrow(/EXECUTOR_SSO_PROVIDER_ID/);    });  });   it("presets Google's discovery document so only credentials + domains are needed", () => {    withSsoEnv(      {        EXECUTOR_SSO_PROVIDER_ID: "google",        EXECUTOR_SSO_CLIENT_ID: "id.apps.googleusercontent.com",        EXECUTOR_SSO_CLIENT_SECRET: "secret",        EXECUTOR_SSO_ALLOWED_DOMAINS: "example.com",      },      () => {        const sso = loadConfig().sso;        expect(sso!.discoveryUrl).toBe(          "https://accounts.google.com/.well-known/openid-configuration",        );        expect(sso!.providerName).toBe("Google");      },    );  });   it("refuses a provider without a known or explicit discovery URL", () => {    withSsoEnv(      {        EXECUTOR_SSO_PROVIDER_ID: "okta",        EXECUTOR_SSO_CLIENT_ID: "id",        EXECUTOR_SSO_CLIENT_SECRET: "secret",        EXECUTOR_SSO_ALLOWED_DOMAINS: "example.com",      },      () => {        expect(() => loadConfig()).toThrow(/EXECUTOR_SSO_DISCOVERY_URL/);      },    );  });   it("refuses a configured provider without a domain allowlist", () => {    withSsoEnv(      {        EXECUTOR_SSO_PROVIDER_ID: "okta",        EXECUTOR_SSO_DISCOVERY_URL: "https://idp.example/.well-known/openid-configuration",        EXECUTOR_SSO_CLIENT_ID: "id",        EXECUTOR_SSO_CLIENT_SECRET: "secret",      },      () => {        expect(() => loadConfig()).toThrow(/EXECUTOR_SSO_ALLOWED_DOMAINS/);      },    );  });}); describe("emailDomain", () => {  it("extracts the lowercased domain of a well-formed address", () => {    expect(emailDomain("User@Example.COM")).toBe("example.com");  });   it("returns null for malformed addresses instead of a matchable domain", () => {    expect(emailDomain("@example.com")).toBeNull();    expect(emailDomain("user@")).toBeNull();    expect(emailDomain("no-at-sign")).toBeNull();  });}); test("auth-config advertises the configured provider (id + name only)", async () => {  const res = await handler(new Request(`${BASE}/api/auth-config`));  expect(res.status).toBe(200);  expect(await res.json()).toEqual({ ssoProviders: [{ id: "okta", name: "Okta" }] });}); // --- The full OIDC round-trip against the emulated IdP ----------------------- const decodeHtml = (value: string): string =>  value    .replaceAll("&amp;", "&")    .replaceAll("&quot;", '"')    .replaceAll("&#x27;", "'")    .replaceAll("&lt;", "<")    .replaceAll("&gt;", ">"); const formFields = (form: string): Record<string, string> => {  const fields: Record<string, string> = {};  for (const input of form.matchAll(/<input\b[^>]*>/gi)) {    const tag = input[0];    const name = tag.match(/\bname=["']([^"']+)["']/i)?.[1];    const value = tag.match(/\bvalue=["']([^"']*)["']/i)?.[1] ?? "";    if (name) fields[decodeHtml(name)] = decodeHtml(value);  }  return fields;}; // Drive the whole flow as the given IdP account: sign-in redirect -> IdP// consent page (pick the account's form) -> callback back into the app.// Returns the callback response plus the cookies it set.const signInThroughIdp = async (email: string) => {  const start = await handler(    new Request(`${BASE}/api/auth/sign-in/oauth2`, {      method: "POST",      headers: { "content-type": "application/json" },      body: JSON.stringify({ providerId: "okta", callbackURL: "/" }),    }),  );  expect(start.status).toBe(200);  const { url } = (await start.json()) as { url: string };  expect(url.startsWith(idp.url)).toBe(true);  const stateCookies = start.headers    .getSetCookie()    .map((cookie) => cookie.split(";")[0]!)    .join("; ");   const consentHtml = await fetch(url).then((r) => r.text());  const form = [...consentHtml.matchAll(/<form[\s\S]*?<\/form>/gi)]    .map((m) => m[0])    .find((f) => f.includes(email));  expect(form).toBeDefined();  const action = decodeHtml(form!.match(/\baction=["']([^"']+)["']/i)![1]!);  const consent = await fetch(action, {    method: "POST",    headers: { "content-type": "application/x-www-form-urlencoded" },    body: new URLSearchParams(formFields(form!)),    redirect: "manual",  });  expect(consent.status).toBe(302);  const callbackUrl = consent.headers.get("location")!;  expect(callbackUrl.startsWith(CALLBACK)).toBe(true);   const callback = await handler(new Request(callbackUrl, { headers: { cookie: stateCookies } }));  const cookies = callback.headers    .getSetCookie()    .map((cookie) => cookie.split(";")[0]!)    .join("; ");  return { callback, cookies };}; test("an allowlisted-domain IdP account signs in and joins the org as a member", async () => {  const { callback, cookies } = await signInThroughIdp("alice@example.com");  expect(callback.status).toBe(302);  expect(callback.headers.get("location")).toBe("/");   const session = await handler(    new Request(`${BASE}/api/auth/get-session`, { headers: { cookie: cookies } }),  );  expect(session.status).toBe(200);  const sessionBody = (await session.json()) as { user?: { email?: string } };  expect(sessionBody.user?.email).toBe("alice@example.com");   const orgs = await handler(    new Request(`${BASE}/api/auth/organization/list`, { headers: { cookie: cookies } }),  );  expect(orgs.status).toBe(200);  expect(((await orgs.json()) as unknown[]).length).toBe(1);}); test("an IdP account outside the allowlist is refused and gets no session", async () => {  const { callback, cookies } = await signInThroughIdp("mallory@evil.test");  // The rejection surfaces as better-auth's error redirect, not a success.  expect(callback.status).toBe(302);  expect(callback.headers.get("location")).not.toBe("/");  expect(callback.headers.get("location")).toContain("error");   const session = await handler(    new Request(`${BASE}/api/auth/get-session`, { headers: { cookie: cookies } }),  );  const sessionBody = (await session.json()) as { user?: unknown } | null;  expect(sessionBody?.user ?? null).toBeNull();}); // --- Invite-code regressions with SSO configured ------------------------------ test("invite-gated email signup still works with an SSO provider configured", async () => {  const inviteCode = await mintInviteCode(handler);  const signUp = await handler(    new Request(`${BASE}/api/auth/sign-up/email`, {      method: "POST",      headers: { "content-type": "application/json" },      body: JSON.stringify({        email: "member@test.local",        password: "member-password-123",        name: "Member",        inviteCode,      }),    }),  );  expect(signUp.status).toBe(200);}); test("email signup without an invite is still refused with an SSO provider configured", async () => {  const signUp = await handler(    new Request(`${BASE}/api/auth/sign-up/email`, {      method: "POST",      headers: { "content-type": "application/json" },      body: JSON.stringify({        email: "stranger@example.com",        password: "stranger-password-123",        name: "Stranger",      }),    }),  );  expect(signUp.status).toBe(403);});