import { env } from "cloudflare:workers";import { expect, it } from "@effect/vitest";import { Data, Effect, Layer } from "effect"; import { WorkOSClient, type WorkOSClientService } from "../auth/workos";import { emailResolver } from "./admin-users-api"; // Cloud's REVERSE directory lookup: email -> the WorkOS `user_...` id that the// subject table records in `external_id`. Production resolves it with one// tenant-scoped list-users query. The WorkOS emulator lacks that route, so// tests/dev retain the membership-backed scan exercised below. const ORG = "org_placeholder";const OTHER_ORG = "org_other"; class WorkOSUnavailable extends Data.TaggedError("WorkOSUnavailable")<{  readonly userId: string;}> {} const DIRECTORY = [  // Same email in another tenant must never win either lookup path.  { id: "user_foreign", email: "ada@placeholder.test", organizationId: OTHER_ORG },  // WorkOS preserves submitted casing, while the resolver seam is normalized.  { id: "user_ada", email: "Ada@Placeholder.test", organizationId: ORG },  { id: "user_grace", email: "grace@placeholder.test", organizationId: ORG },  { id: "user_nameless", email: null, organizationId: ORG },] as const; const stubWorkOS = (calls: string[], unreadableUserIds: ReadonlySet<string>) =>  Layer.succeed(    WorkOSClient,    new Proxy({} as WorkOSClientService, {      get: (_target, prop) => {        if (prop === "listUsers") {          return (params: { email: string; organizationId: string }) => {            calls.push(`listUsers:${params.organizationId}:${params.email}`);            return Effect.succeed({              data: DIRECTORY.filter(                (user) =>                  user.organizationId === params.organizationId &&                  user.email?.toLowerCase() === params.email,              ),            });          };        }        if (prop === "listOrgMembers") {          return (organizationId: string) => {            calls.push(`listOrgMembers:${organizationId}`);            return Effect.succeed({              data: DIRECTORY.filter((user) => user.organizationId === organizationId).map(                (user) => ({ userId: user.id, organizationId }),              ),            });          };        }        if (prop === "getUser") {          return (userId: string) => {            calls.push(`getUser:${userId}`);            if (unreadableUserIds.has(userId)) {              return Effect.fail(new WorkOSUnavailable({ userId }));            }            const user = DIRECTORY.find((candidate) => candidate.id === userId);            if (!user) return Effect.die(`unexpected user ${userId}`);            return Effect.succeed(user);          };        }        return () => Effect.die(`unexpected WorkOSClient.${String(prop)} call`);      },    }),  ); const resolve = (  email: string,  calls: string[],  emulator = false,  unreadableUserIds: ReadonlySet<string> = new Set(),) => {  const previousApiUrl = env.WORKOS_API_URL;  return Effect.gen(function* () {    yield* Effect.sync(() =>      Object.assign(env, {        WORKOS_API_URL: emulator ? "http://workos-emulator.invalid" : undefined,      }),    );    const context = yield* Effect.context<WorkOSClient>();    return yield* emailResolver(ORG, context)(email);  }).pipe(    Effect.provide(stubWorkOS(calls, unreadableUserIds)),    Effect.ensuring(Effect.sync(() => Object.assign(env, { WORKOS_API_URL: previousApiUrl }))),  );}; it.effect("resolves an email with one tenant-scoped WorkOS query", () =>  Effect.gen(function* () {    const calls: string[] = [];    expect(yield* resolve("ada@placeholder.test", calls)).toBe("user_ada");    expect(calls).toEqual([`listUsers:${ORG}:ada@placeholder.test`]);  }),); it.effect("returns null from one query when the organization has no matching email", () =>  Effect.gen(function* () {    const calls: string[] = [];    expect(yield* resolve("nobody@placeholder.test", calls)).toBeNull();    expect(calls).toEqual([`listUsers:${ORG}:nobody@placeholder.test`]);  }),); it.effect("keeps the emulator fallback tenant-scoped and case-insensitive", () =>  Effect.gen(function* () {    const calls: string[] = [];    expect(yield* resolve("ada@placeholder.test", calls, true)).toBe("user_ada");    expect(calls).toEqual([`listOrgMembers:${ORG}`, "getUser:user_ada"]);    expect(calls).not.toContain("getUser:user_foreign");    expect(calls.some((call) => call.startsWith("listUsers:"))).toBe(false);  }),); it.effect("lets the emulator fallback continue past one unreadable member", () =>  Effect.gen(function* () {    const calls: string[] = [];    expect(yield* resolve("grace@placeholder.test", calls, true, new Set(["user_ada"]))).toBe(      "user_grace",    );    expect(calls).toEqual([`listOrgMembers:${ORG}`, "getUser:user_ada", "getUser:user_grace"]);  }),);