import { describe, expect, it } from "@effect/vitest";import { Effect, Layer } from "effect"; import { ApiKeyService } from "./api-keys";import { UserStoreService } from "./context";import { WorkOSClient, type WorkOSClientService } from "./workos";import { isPlatformAuth, resolveApiKeyPrincipal, resolveBearerAuth } from "./workos-auth-provider"; // Groundwork for the PRIVILEGED, org-level API key: it resolves to the platform// view (tenant-wide, read-only, NO acting member) rather than to a member// `Principal`. The product surfaces must reject it outright rather than// inventing a subject for it — that is the property these tests pin. const createdAt = new Date("2026-01-01T00:00:00.000Z"); const stubApiKeys = Layer.succeed(ApiKeyService)({ validate: (value: string) => { if (value === "valid_org_key") { return Effect.succeed({ scope: "org" as const, accountId: null, organizationId: "org_123", keyId: "api_key_org", }); } if (value === "valid_user_key") { return Effect.succeed({ scope: "user" as const, accountId: "user_123", organizationId: "org_123", keyId: "api_key_123", }); } return Effect.succeed(null); }, listUserKeys: () => Effect.succeed([]), createUserKey: () => Effect.die("org api key test does not create API keys"), revokeUserKey: () => Effect.void,}); const stubWorkOS = Layer.succeed( WorkOSClient, new Proxy({} as WorkOSClientService, { get: (_target, prop) => { if (prop === "listUserMemberships") { return (userId: string) => Effect.succeed({ data: userId === "user_123" ? [{ userId, organizationId: "org_123", status: "active" }] : [], }); } // An org key must NOT trigger a membership check — there is no user to // check. Any such call dies here, which is the assertion. return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`); }, }),); const stubUsers = Layer.succeed(UserStoreService)({ use: (fn) => Effect.promise(() => fn({ ensureAccount: async (id: string) => ({ id, createdAt }), getAccount: async (id: string) => ({ id, createdAt }), upsertOrganization: async (org: { id: string; name: string }) => ({ ...org, slug: `org-slug-${org.id}`, createdAt, }), getOrganization: async (id: string) => ({ id, name: `Org ${id}`, slug: `org-slug-${id}`, createdAt, }), getOrganizationBySlug: async (slug: string) => ({ id: "org_by_slug", name: `Org ${slug}`, slug, createdAt, }), deleteOrganizationCascade: async () => {}, }), ),}); const layers = Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers); const bearer = (token: string) => new Request("https://executor.test/api/tools", { headers: { authorization: `Bearer ${token}` }, }); describe("org-level API keys", () => { it.effect("resolve to the platform view with no acting member", () => Effect.gen(function* () { const auth = yield* resolveBearerAuth(bearer("valid_org_key")).pipe(Effect.provide(layers)); expect(isPlatformAuth(auth)).toBe(true); expect(auth).toEqual({ kind: "platform", organizationId: "org_123", organizationName: "Org org_123", organizationSlug: "org-slug-org_123", keyId: "api_key_org", }); // No `accountId` anywhere in the shape: nothing downstream can bind a // subject from it by accident. expect(auth).not.toHaveProperty("accountId"); }), ); it.effect("user keys still resolve to a bound member principal", () => Effect.gen(function* () { const auth = yield* resolveBearerAuth(bearer("valid_user_key")).pipe(Effect.provide(layers)); expect(isPlatformAuth(auth)).toBe(false); expect(auth).toMatchObject({ accountId: "user_123", organizationId: "org_123" }); }), ); it.effect("are REJECTED on the product surface rather than bound to a subject", () => Effect.gen(function* () { // THE security property of the api-key half: a product request carrying // an org key must fail, not silently act as some user. const error = yield* Effect.flip( resolveApiKeyPrincipal(bearer("valid_org_key")).pipe(Effect.provide(layers)), ); expect(error).toMatchObject({ _tag: "Unauthorized", code: "invalid_api_key", message: "Organization API keys cannot be used on this endpoint", }); }), ); it.effect("do not trigger a user membership check", () => Effect.gen(function* () { // `authorizeOrganization` checks a USER's live membership; there is no // user here. The WorkOS stub dies on any call other than the user path, // so a clean resolution proves the org branch never took it. const auth = yield* resolveBearerAuth(bearer("valid_org_key")).pipe(Effect.provide(layers)); expect(isPlatformAuth(auth)).toBe(true); }), );});
import { describe, expect, it } from "@effect/vitest";
import { Effect, Layer } from "effect";
import { ApiKeyService } from "./api-keys";
import { UserStoreService } from "./context";
import { WorkOSClient, type WorkOSClientService } from "./workos";
import { isPlatformAuth, resolveApiKeyPrincipal, resolveBearerAuth } from "./workos-auth-provider";
// Groundwork for the PRIVILEGED, org-level API key: it resolves to the platform
// view (tenant-wide, read-only, NO acting member) rather than to a member
// `Principal`. The product surfaces must reject it outright rather than
// inventing a subject for it — that is the property these tests pin.
const createdAt = new Date("2026-01-01T00:00:00.000Z");
const stubApiKeys = Layer.succeed(ApiKeyService)({
validate: (value: string) => {
if (value === "valid_org_key") {
return Effect.succeed({
scope: "org" as const,
accountId: null,
organizationId: "org_123",
keyId: "api_key_org",
});
}
if (value === "valid_user_key") {
return Effect.succeed({
scope: "user" as const,
accountId: "user_123",
organizationId: "org_123",
keyId: "api_key_123",
});
}
return Effect.succeed(null);
},
listUserKeys: () => Effect.succeed([]),
createUserKey: () => Effect.die("org api key test does not create API keys"),
revokeUserKey: () => Effect.void,
});
const stubWorkOS = Layer.succeed(
WorkOSClient,
new Proxy({} as WorkOSClientService, {
get: (_target, prop) => {
if (prop === "listUserMemberships") {
return (userId: string) =>
Effect.succeed({
data:
userId === "user_123"
? [{ userId, organizationId: "org_123", status: "active" }]
: [],
});
}
// An org key must NOT trigger a membership check — there is no user to
// check. Any such call dies here, which is the assertion.
return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);
},
}),
);
const stubUsers = Layer.succeed(UserStoreService)({
use: (fn) =>
Effect.promise(() =>
fn({
ensureAccount: async (id: string) => ({ id, createdAt }),
getAccount: async (id: string) => ({ id, createdAt }),
upsertOrganization: async (org: { id: string; name: string }) => ({
...org,
slug: `org-slug-${org.id}`,
createdAt,
}),
getOrganization: async (id: string) => ({
id,
name: `Org ${id}`,
slug: `org-slug-${id}`,
createdAt,
}),
getOrganizationBySlug: async (slug: string) => ({
id: "org_by_slug",
name: `Org ${slug}`,
slug,
createdAt,
}),
deleteOrganizationCascade: async () => {},
}),
),
});
const layers = Layer.mergeAll(stubApiKeys, stubWorkOS, stubUsers);
const bearer = (token: string) =>
new Request("https://executor.test/api/tools", {
headers: { authorization: `Bearer ${token}` },
});
describe("org-level API keys", () => {
it.effect("resolve to the platform view with no acting member", () =>
Effect.gen(function* () {
const auth = yield* resolveBearerAuth(bearer("valid_org_key")).pipe(Effect.provide(layers));
expect(isPlatformAuth(auth)).toBe(true);
expect(auth).toEqual({
kind: "platform",
organizationId: "org_123",
organizationName: "Org org_123",
organizationSlug: "org-slug-org_123",
keyId: "api_key_org",
});
// No `accountId` anywhere in the shape: nothing downstream can bind a
// subject from it by accident.
expect(auth).not.toHaveProperty("accountId");
}),
);
it.effect("user keys still resolve to a bound member principal", () =>
Effect.gen(function* () {
const auth = yield* resolveBearerAuth(bearer("valid_user_key")).pipe(Effect.provide(layers));
expect(isPlatformAuth(auth)).toBe(false);
expect(auth).toMatchObject({ accountId: "user_123", organizationId: "org_123" });
}),
);
it.effect("are REJECTED on the product surface rather than bound to a subject", () =>
Effect.gen(function* () {
// THE security property of the api-key half: a product request carrying
// an org key must fail, not silently act as some user.
const error = yield* Effect.flip(
resolveApiKeyPrincipal(bearer("valid_org_key")).pipe(Effect.provide(layers)),
);
expect(error).toMatchObject({
_tag: "Unauthorized",
code: "invalid_api_key",
message: "Organization API keys cannot be used on this endpoint",
});
}),
);
it.effect("do not trigger a user membership check", () =>
Effect.gen(function* () {
// `authorizeOrganization` checks a USER's live membership; there is no
// user here. The WorkOS stub dies on any call other than the user path,
// so a clean resolution proves the org branch never took it.
const auth = yield* resolveBearerAuth(bearer("valid_org_key")).pipe(Effect.provide(layers));
expect(isPlatformAuth(auth)).toBe(true);
}),
);
});