// ---------------------------------------------------------------------------// Local app auth failure propagation// ---------------------------------------------------------------------------//// Exercises the local HTTP API boundary://// test -> HttpApiClient -> in-process LocalApi -> execution engine// -> sandbox code -> OpenAPI tool invocation//// The assertion is intentionally on the final execution payload, not the// plugin facade, so reviewers can see that model-visible tool results carry// auth guidance instead of an opaque internal tool error.//// v2: a connection IS the credential. addSpec registers the integration with an// apiKey auth template; a connection is then created whose value cannot resolve// (a `from` reference to a missing provider item). Invoking one of that// connection's tools surfaces `connection_value_missing` to the model.// --------------------------------------------------------------------------- import { afterAll, beforeAll, describe, expect, it } from "@effect/vitest";import { randomBytes } from "node:crypto";import { mkdtempSync, rmSync } from "node:fs";import { tmpdir } from "node:os";import { join } from "node:path"; import { Effect, Layer, Schema } from "effect";import { FetchHttpClient, HttpRouter, HttpServer } from "effect/unstable/http";import { HttpApi, HttpApiBuilder, HttpApiClient, HttpApiEndpoint, HttpApiGroup,} from "effect/unstable/httpapi"; import { addGroup, observabilityMiddleware } from "@executor-js/api";import { CoreHandlers, ExecutionEngineService, ExecutorService, collectTables,} from "@executor-js/api/server";import { createExecutionEngine } from "@executor-js/execution";import { fileSecretsPlugin } from "@executor-js/plugin-file-secrets";import { openApiPlugin } from "@executor-js/plugin-openapi";import { OpenApiExtensionService, OpenApiGroup, OpenApiHandlers,} from "@executor-js/plugin-openapi/api";import { makeOpenApiHttpApiTestAddSpecPayload } from "@executor-js/plugin-openapi/testing";import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs";import { AuthTemplateSlug, ConnectionName, IntegrationSlug, ProviderItemId, ProviderKey, Subject, Tenant, createExecutor,} from "@executor-js/sdk";import { memoryCredentialsPlugin } from "@executor-js/sdk/testing"; import { ErrorCaptureLive } from "./observability";import { createSqliteFumaDb } from "./db/sqlite-fumadb"; const TEST_BASE_URL = "http://local.test"; const PingGroup = HttpApiGroup.make("default", { topLevel: true }).add( HttpApiEndpoint.get("ping", "/ping", { success: Schema.Unknown }),); const MissingAuthSourceApi = HttpApi.make("localAuthFailureSource").add(PingGroup); const TestApi = addGroup(OpenApiGroup);type TestApiShape = typeof TestApi extends HttpApi.HttpApi<infer _Id, infer Groups> ? HttpApiClient.Client<Groups, never> : never; const API_KEY_TEMPLATE = "apiKey"; interface Harness { readonly fetch: typeof globalThis.fetch; readonly addConnection: (input: { readonly integration: string; readonly connection: string; }) => Promise<void>; readonly dispose: () => Promise<void>;} const startHarness = async (tmpDir: string): Promise<Harness> => { const plugins = [ openApiPlugin({ httpClientLayer: FetchHttpClient.layer }), fileSecretsPlugin({ directory: tmpDir }), memoryCredentialsPlugin(), ] as const; const sqlite = await createSqliteFumaDb({ tables: collectTables(), namespace: "executor_local_auth_tool_failures_test", path: join(tmpDir, "data.db"), }); const executor = await Effect.runPromise( createExecutor({ tenant: Tenant.make(`test-${randomBytes(4).toString("hex")}`), subject: Subject.make("local"), db: sqlite.db, plugins, onElicitation: "accept-all", }), ); const engine = createExecutionEngine({ executor, codeExecutor: makeQuickJsExecutor(), }); const TestObservability = observabilityMiddleware(TestApi); const TestApiBase = HttpApiBuilder.layer(TestApi).pipe( Layer.provide(CoreHandlers), Layer.provide(OpenApiHandlers), Layer.provide(TestObservability), Layer.provide(ErrorCaptureLive), ); const { handler: webHandler, dispose: disposeHandler } = HttpRouter.toWebHandler( TestApiBase.pipe( Layer.provideMerge(Layer.succeed(OpenApiExtensionService)(executor.openapi)), Layer.provideMerge(Layer.succeed(ExecutorService)(executor)), Layer.provideMerge(Layer.succeed(ExecutionEngineService)(engine)), Layer.provideMerge(HttpServer.layerServices), Layer.provideMerge(Layer.succeed(HttpRouter.RouterConfig)({ maxParamLength: 1000 })), ), ); return { fetch: ((input: RequestInfo | URL, init?: RequestInit) => webHandler( input instanceof Request ? input : new Request(input, init), )) as typeof globalThis.fetch, // Create an org connection whose value cannot resolve: a `from` reference // to a memory-provider item that was never stored resolves to `null`, so // tool invocation surfaces `connection_value_missing`. addConnection: (input) => Effect.runPromise( executor.connections .create({ owner: "org", name: ConnectionName.make(input.connection), integration: IntegrationSlug.make(input.integration), template: AuthTemplateSlug.make(API_KEY_TEMPLATE), from: { provider: ProviderKey.make("memory"), id: ProviderItemId.make(`${input.integration}-missing`), }, }) .pipe(Effect.asVoid), ), dispose: async () => { await Effect.runPromise(Effect.ignore(Effect.tryPromise(() => disposeHandler()))); await Effect.runPromise( Effect.ignore(Effect.tryPromise(() => Effect.runPromise(executor.close()))), ); await sqlite.close(); }, };}; const run = <A, E>(body: (client: TestApiShape) => Effect.Effect<A, E>): Effect.Effect<A, E> => Effect.gen(function* () { const client = yield* HttpApiClient.make(TestApi, { baseUrl: TEST_BASE_URL, }); return yield* body(client); }).pipe( Effect.provide( FetchHttpClient.layer.pipe( Layer.provide(Layer.succeed(FetchHttpClient.Fetch)(harness.fetch)), ), ), ) as Effect.Effect<A, E>; type EffectSuccess<T> = T extends Effect.Effect<infer A, unknown, unknown> ? A : never;type ExecuteResult = EffectSuccess<ReturnType<TestApiShape["executions"]["execute"]>>; const expectModelVisibleAuthFailure = (execution: ExecuteResult) => { expect(execution.status).toBe("completed"); if (execution.status !== "completed") return; expect(execution.isError).toBe(false); expect(JSON.stringify(execution.structured)).not.toContain("Internal tool error"); expect(JSON.stringify(execution.structured)).not.toContain("Internal Tool Error"); expect(execution.structured).toMatchObject({ status: "completed", result: { ok: false, error: { code: "connection_value_missing", details: { category: "authentication", recovery: { createConnectionTool: "executor.coreTools.connections.createHandoff", listConnectionsTool: "executor.coreTools.connections.list", }, }, }, }, });}; let tmpDir: string;let harness: Harness; beforeAll(async () => { tmpDir = mkdtempSync(join(tmpdir(), "executor-local-auth-tool-failures-")); harness = await startHarness(tmpDir);}); afterAll(async () => { await harness.dispose(); rmSync(tmpDir, { recursive: true, force: true });}); describe("local auth tool failures", () => { it.effect("local propagates missing credential value as model-visible auth failure", () => Effect.gen(function* () { const integration = `auth_${randomBytes(4).toString("hex")}`; const connection = "main"; yield* run((client) => client.openapi.addSpec({ payload: { ...makeOpenApiHttpApiTestAddSpecPayload(MissingAuthSourceApi, { slug: integration, authenticationTemplate: [ { slug: AuthTemplateSlug.make(API_KEY_TEMPLATE), type: "apiKey" as const, headers: { Authorization: ["Bearer ", { type: "variable" as const, name: "token" }], }, }, ], }), baseUrl: "https://api.example.test", }, }), ); yield* Effect.promise(() => harness.addConnection({ integration, connection })); const execution = yield* run((client) => client.executions.execute({ payload: { code: [ `const result = await tools.${integration}.org.${connection}.default.ping({});`, "return result;", ].join("\n"), }, }), ); expectModelVisibleAuthFailure(execution); }), );});
// ---------------------------------------------------------------------------
// Local app auth failure propagation
// ---------------------------------------------------------------------------
//
// Exercises the local HTTP API boundary:
//
// test -> HttpApiClient -> in-process LocalApi -> execution engine
// -> sandbox code -> OpenAPI tool invocation
//
// The assertion is intentionally on the final execution payload, not the
// plugin facade, so reviewers can see that model-visible tool results carry
// auth guidance instead of an opaque internal tool error.
//
// v2: a connection IS the credential. addSpec registers the integration with an
// apiKey auth template; a connection is then created whose value cannot resolve
// (a `from` reference to a missing provider item). Invoking one of that
// connection's tools surfaces `connection_value_missing` to the model.
// ---------------------------------------------------------------------------
import { afterAll, beforeAll, describe, expect, it } from "@effect/vitest";
import { randomBytes } from "node:crypto";
import { mkdtempSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { Effect, Layer, Schema } from "effect";
import { FetchHttpClient, HttpRouter, HttpServer } from "effect/unstable/http";
import {
HttpApi,
HttpApiBuilder,
HttpApiClient,
HttpApiEndpoint,
HttpApiGroup,
} from "effect/unstable/httpapi";
import { addGroup, observabilityMiddleware } from "@executor-js/api";
import {
CoreHandlers,
ExecutionEngineService,
ExecutorService,
collectTables,
} from "@executor-js/api/server";
import { createExecutionEngine } from "@executor-js/execution";
import { fileSecretsPlugin } from "@executor-js/plugin-file-secrets";
import { openApiPlugin } from "@executor-js/plugin-openapi";
import {
OpenApiExtensionService,
OpenApiGroup,
OpenApiHandlers,
} from "@executor-js/plugin-openapi/api";
import { makeOpenApiHttpApiTestAddSpecPayload } from "@executor-js/plugin-openapi/testing";
import { makeQuickJsExecutor } from "@executor-js/runtime-quickjs";
import {
AuthTemplateSlug,
ConnectionName,
IntegrationSlug,
ProviderItemId,
ProviderKey,
Subject,
Tenant,
createExecutor,
} from "@executor-js/sdk";
import { memoryCredentialsPlugin } from "@executor-js/sdk/testing";
import { ErrorCaptureLive } from "./observability";
import { createSqliteFumaDb } from "./db/sqlite-fumadb";
const TEST_BASE_URL = "http://local.test";
const PingGroup = HttpApiGroup.make("default", { topLevel: true }).add(
HttpApiEndpoint.get("ping", "/ping", { success: Schema.Unknown }),
);
const MissingAuthSourceApi = HttpApi.make("localAuthFailureSource").add(PingGroup);
const TestApi = addGroup(OpenApiGroup);
type TestApiShape =
typeof TestApi extends HttpApi.HttpApi<infer _Id, infer Groups>
? HttpApiClient.Client<Groups, never>
: never;
const API_KEY_TEMPLATE = "apiKey";
interface Harness {
readonly fetch: typeof globalThis.fetch;
readonly addConnection: (input: {
readonly integration: string;
readonly connection: string;
}) => Promise<void>;
readonly dispose: () => Promise<void>;
}
const startHarness = async (tmpDir: string): Promise<Harness> => {
const plugins = [
openApiPlugin({ httpClientLayer: FetchHttpClient.layer }),
fileSecretsPlugin({ directory: tmpDir }),
memoryCredentialsPlugin(),
] as const;
const sqlite = await createSqliteFumaDb({
tables: collectTables(),
namespace: "executor_local_auth_tool_failures_test",
path: join(tmpDir, "data.db"),
});
const executor = await Effect.runPromise(
createExecutor({
tenant: Tenant.make(`test-${randomBytes(4).toString("hex")}`),
subject: Subject.make("local"),
db: sqlite.db,
plugins,
onElicitation: "accept-all",
}),
);
const engine = createExecutionEngine({
executor,
codeExecutor: makeQuickJsExecutor(),
});
const TestObservability = observabilityMiddleware(TestApi);
const TestApiBase = HttpApiBuilder.layer(TestApi).pipe(
Layer.provide(CoreHandlers),
Layer.provide(OpenApiHandlers),
Layer.provide(TestObservability),
Layer.provide(ErrorCaptureLive),
);
const { handler: webHandler, dispose: disposeHandler } = HttpRouter.toWebHandler(
TestApiBase.pipe(
Layer.provideMerge(Layer.succeed(OpenApiExtensionService)(executor.openapi)),
Layer.provideMerge(Layer.succeed(ExecutorService)(executor)),
Layer.provideMerge(Layer.succeed(ExecutionEngineService)(engine)),
Layer.provideMerge(HttpServer.layerServices),
Layer.provideMerge(Layer.succeed(HttpRouter.RouterConfig)({ maxParamLength: 1000 })),
),
);
return {
fetch: ((input: RequestInfo | URL, init?: RequestInit) =>
webHandler(
input instanceof Request ? input : new Request(input, init),
)) as typeof globalThis.fetch,
// Create an org connection whose value cannot resolve: a `from` reference
// to a memory-provider item that was never stored resolves to `null`, so
// tool invocation surfaces `connection_value_missing`.
addConnection: (input) =>
Effect.runPromise(
executor.connections
.create({
owner: "org",
name: ConnectionName.make(input.connection),
integration: IntegrationSlug.make(input.integration),
template: AuthTemplateSlug.make(API_KEY_TEMPLATE),
from: {
provider: ProviderKey.make("memory"),
id: ProviderItemId.make(`${input.integration}-missing`),
},
})
.pipe(Effect.asVoid),
),
dispose: async () => {
await Effect.runPromise(Effect.ignore(Effect.tryPromise(() => disposeHandler())));
await Effect.runPromise(
Effect.ignore(Effect.tryPromise(() => Effect.runPromise(executor.close()))),
);
await sqlite.close();
},
};
};
const run = <A, E>(body: (client: TestApiShape) => Effect.Effect<A, E>): Effect.Effect<A, E> =>
Effect.gen(function* () {
const client = yield* HttpApiClient.make(TestApi, {
baseUrl: TEST_BASE_URL,
});
return yield* body(client);
}).pipe(
Effect.provide(
FetchHttpClient.layer.pipe(
Layer.provide(Layer.succeed(FetchHttpClient.Fetch)(harness.fetch)),
),
),
) as Effect.Effect<A, E>;
type EffectSuccess<T> = T extends Effect.Effect<infer A, unknown, unknown> ? A : never;
type ExecuteResult = EffectSuccess<ReturnType<TestApiShape["executions"]["execute"]>>;
const expectModelVisibleAuthFailure = (execution: ExecuteResult) => {
expect(execution.status).toBe("completed");
if (execution.status !== "completed") return;
expect(execution.isError).toBe(false);
expect(JSON.stringify(execution.structured)).not.toContain("Internal tool error");
expect(JSON.stringify(execution.structured)).not.toContain("Internal Tool Error");
expect(execution.structured).toMatchObject({
status: "completed",
result: {
ok: false,
error: {
code: "connection_value_missing",
details: {
category: "authentication",
recovery: {
createConnectionTool: "executor.coreTools.connections.createHandoff",
listConnectionsTool: "executor.coreTools.connections.list",
},
},
},
},
});
};
let tmpDir: string;
let harness: Harness;
beforeAll(async () => {
tmpDir = mkdtempSync(join(tmpdir(), "executor-local-auth-tool-failures-"));
harness = await startHarness(tmpDir);
});
afterAll(async () => {
await harness.dispose();
rmSync(tmpDir, { recursive: true, force: true });
});
describe("local auth tool failures", () => {
it.effect("local propagates missing credential value as model-visible auth failure", () =>
Effect.gen(function* () {
const integration = `auth_${randomBytes(4).toString("hex")}`;
const connection = "main";
yield* run((client) =>
client.openapi.addSpec({
payload: {
...makeOpenApiHttpApiTestAddSpecPayload(MissingAuthSourceApi, {
slug: integration,
authenticationTemplate: [
{
slug: AuthTemplateSlug.make(API_KEY_TEMPLATE),
type: "apiKey" as const,
headers: {
Authorization: ["Bearer ", { type: "variable" as const, name: "token" }],
},
},
],
}),
baseUrl: "https://api.example.test",
},
}),
);
yield* Effect.promise(() => harness.addConnection({ integration, connection }));
const execution = yield* run((client) =>
client.executions.execute({
payload: {
code: [
`const result = await tools.${integration}.org.${connection}.default.ping({});`,
"return result;",
].join("\n"),
},
}),
);
expectModelVisibleAuthFailure(execution);
}),
);
});