// Cloud-only: the connect deep link's REASON FOR CARRYING AN ORG SLUG.//// An operator on the admin Users page copies a connect link for a member who// hasn't connected something yet and sends it to them. `connectLinkUrl` builds// that link org-PREFIXED (`/<org>/connect/<slug>`) rather than bare, and the// failure that choice prevents is specific and silent: a recipient who belongs// to several workspaces has ONE session-default org, and a bare `/connect/x`// resolves against THAT one. They would land in the wrong workspace, connect a// real credential there, and nothing anywhere would report a problem — the// connection succeeds, it is just in the wrong tenant. The sender then keeps// seeing an unconnected user.//// The existing coverage cannot catch this. `scenarios/connect-deep-link.test.ts`// deliberately accepts EITHER URL form (it runs on hosts with and without an// org segment) and its user belongs to one org, so both forms resolve to the// same place. `packages/react/src/routes/connect-deep-link.test.ts` only proves// the router parses the param. Neither has a second org to land in by mistake.//// So: a recipient who is a plain member of TWO orgs, whose session defaults to// org B, follows an org-A-scoped link. The request must open the forced-Personal// connection flow in org A — never enter a connection flow in B.//// Both orgs register an integration under the SAME slug — that is what makes// this a real test. With distinct slugs, org B's catalog would simply not// contain the link's slug and the page would show its not-found state, so the// scenario would pass for the wrong reason (a lookup miss rather than correct// scoping). Sharing the slug means BOTH orgs can satisfy the link, and only the// org prefix decides which one does.import { randomBytes } from "node:crypto"; import { expect } from "@effect/vitest";import { Effect } from "effect";import type { HttpApiClient } from "effect/unstable/httpapi";import { composePluginApi } from "@executor-js/api/server";import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";import { IntegrationSlug } from "@executor-js/sdk/shared"; import { scenario } from "../src/scenario";import { Api, Browser, Target } from "../src/services";import { activeOrg, forBrowser, joinOrg, organizationsOf } from "./support/session"; const api = composePluginApi([openApiHttpPlugin()] as const);type Client = HttpApiClient.ForApi<typeof api>; const INTEGRATION_TITLE = "Ping API"; /** Minimal OpenAPI spec with a single GET /ping — never contacted here. */const pingSpec = JSON.stringify({  openapi: "3.0.3",  info: { title: INTEGRATION_TITLE, version: "1.0.0" },  paths: {    "/ping": {      get: { operationId: "ping", summary: "Ping", responses: { "200": { description: "pong" } } },    },  },}); /** Register an apiKey-authenticated integration under an EXACT slug, so both *  orgs can hold the same catalog identity. */const registerIntegration = (client: Client, slug: IntegrationSlug) =>  client.openapi.addSpec({    payload: {      spec: { kind: "blob", value: pingSpec },      slug,      baseUrl: "http://127.0.0.1:59999", // never contacted during registration      authenticationTemplate: [        {          slug: "apiKey",          type: "apiKey",          headers: { authorization: ["Bearer ", { type: "variable", name: "token" }] },        },      ],    },  }); scenario(  "Connect · an org-scoped connect link resolves a multi-org recipient in the SENDING org",  { timeout: 180_000 },  Effect.gen(function* () {    const target = yield* Target;    const browser = yield* Browser;    const { client: apiClient } = yield* Api;     // Two workspaces with two different owners, and one person invited into    // both. Built through the real invite flow, so the memberships are the ones    // WorkOS actually issues.    const ownerA = yield* target.newIdentity();    const ownerB = yield* target.newIdentity();    const recipientSeed = yield* target.newIdentity({ org: false });     const joinedA = yield* joinOrg(target, ownerA, recipientSeed);    // Accepting B's invitation SECOND re-seals the session onto org B, which is    // exactly the hazard: the recipient's default is now the wrong workspace    // for the link they are about to follow.    const inOrgB = yield* joinOrg(target, ownerB, joinedA);     // `joinedA`'s cookie was re-sealed by the SECOND accept, so it is stale and    // must not be used to read anything — the recipient's live session is    // `inOrgB`, pointed at whichever org a given read is about.    const orgA = yield* activeOrg(target, ownerA);    const orgB = yield* activeOrg(target, inOrgB);    expect(orgA.id, "the two workspaces are genuinely different").not.toBe(orgB.id);     const memberships = yield* organizationsOf(target, inOrgB);    expect(      memberships.organizations.map((org) => org.id).sort(),      "the recipient really is a member of BOTH workspaces",    ).toEqual([orgA.id, orgB.id].sort());    expect(      memberships.activeOrganizationId,      "and their session defaults to org B — the org the link does NOT point at",    ).toBe(orgB.id);     const ownerAClient = yield* apiClient(api, ownerA);    const ownerBClient = yield* apiClient(api, ownerB);     // ONE slug, registered in BOTH catalogs (see the header note).    const slug = IntegrationSlug.make(`multiorg-${randomBytes(4).toString("hex")}`);     yield* Effect.ensuring(      Effect.gen(function* () {        yield* registerIntegration(ownerAClient, slug);        yield* registerIntegration(ownerBClient, slug);         // The link an operator copies off org A's Users page. Built here the        // same way the page builds it (origin + org prefix + slug); the page's        // own rendering of it is asserted in `admin-users-console.test.ts`.        const origin = new URL(target.baseUrl).origin;        const connectLink = `${origin}/${orgA.slug}/connect/${slug}`;         // The recipient follows the link with their org-B-default session.        yield* browser.session(forBrowser(inOrgB), async ({ page, step }) => {          await step("Follow the org-A connect link with an org-B session", async () => {            // `domcontentloaded`, not `networkidle`: the console holds live            // connections open, so idle is not a state this page reaches. The            // real wait is the redirect assertion below.            await page.goto(connectLink, { waitUntil: "domcontentloaded" });            // A plain member can add a Personal connection. The org-A prefix            // still proves the link resolved against the SENDING workspace            // rather than session org B.            await page.waitForURL((url) => url.pathname === `/${orgA.slug}/integrations/${slug}`, {              timeout: 30_000,            });            expect(              new URL(page.url()).pathname.split("/").filter(Boolean)[0],              "the Personal add flow is scoped to the SENDING org, not the session default",            ).toBe(orgA.slug);            expect(              new URL(page.url()).searchParams.get("addAccount"),              "the member enters the add-account route",            ).toBe("1");            const dialog = page.getByRole("dialog");            await dialog              .getByText(`Add connection · ${INTEGRATION_TITLE}`, { exact: false })              .waitFor({ state: "visible", timeout: 30_000 });            expect(              await dialog.getByText("Workspace", { exact: true }).count(),              "the member is forced to Personal scope",            ).toBe(0);          });           await step("Complete the Personal connection in org A", async () => {            const dialog = page.getByRole("dialog");            const credential = dialog.getByRole("textbox", { name: "authorization" });            await credential.waitFor({ state: "visible", timeout: 90_000 });            await credential.fill("recipient-personal-token");            await dialog.getByRole("button", { name: "Continue" }).click();            await dialog.getByRole("button", { name: "Add connection" }).click();            await page              .getByText(`Personal ${INTEGRATION_TITLE}`, { exact: true })              .first()              .waitFor({ state: "visible", timeout: 90_000 });            expect(              new URL(page.url()).pathname.split("/").filter(Boolean)[0],              "the submitted Personal connection stayed in the sending org",            ).toBe(orgA.slug);          });           // ── The other half: it is NOT in the session's default org ─────────          //          // Same person, same session, same integration slug — the only thing          // that differs is the org in the URL. Org B registered the SAME slug,          // so this page exists and must resolve an empty connection list.          await step("Org B has no persisted connection", async () => {            await page.goto(`${origin}/${orgB.slug}/integrations/${slug}?tab=accounts`, {              waitUntil: "domcontentloaded",            });            const add = page.getByRole("button", { name: "Add connection" });            await add.waitFor({ state: "visible", timeout: 90_000 });            await page              .getByText("No connections", { exact: false })              .first()              .waitFor({ state: "visible", timeout: 90_000 });            expect(              new URL(page.url()).pathname.split("/").filter(Boolean)[0],              "navigating explicitly to org B changes the active add-flow scope",            ).toBe(orgB.slug);            expect(              await page.getByText(`Personal ${INTEGRATION_TITLE}`, { exact: true }).count(),              "the submitted connection did not land in the session-default org",            ).toBe(0);          });        });      }),      // Remove the same-slug fixtures from both organizations.      Effect.all(        [          ownerAClient.openapi.removeSpec({ params: { slug } }).pipe(Effect.ignore),          ownerBClient.openapi.removeSpec({ params: { slug } }).pipe(Effect.ignore),        ],        { discard: true },      ),    );  }),);