import { describe, expect, it } from "@effect/vitest";import * as Effect from "effect/Effect";import * as Option from "effect/Option"; import {  AuthArtifactIdSchema,  SourceIdSchema,  WorkspaceIdSchema,  type Source,} from "#schema"; import { resolveSourceAuthMaterialWithDeps } from "./source-auth-material"; const makeSource = (overrides: Partial<Source> = {}): Source => ({  id: SourceIdSchema.make("src_tool_artifacts"),  workspaceId: WorkspaceIdSchema.make("ws_tool_artifacts"),  name: "GitHub",  kind: "openapi",  endpoint: "https://api.github.com",  status: "connected",  enabled: true,  namespace: "github",  bindingVersion: 1,  binding: {    specUrl: "https://api.github.com/openapi.json",    defaultHeaders: null,  },  importAuthPolicy: "reuse_runtime",  importAuth: { kind: "none" },  auth: { kind: "none" },  sourceHash: null,  lastError: null,  createdAt: 1000,  updatedAt: 1000,  ...overrides,}); describe("source-auth-material", () => {  describe("resolveSourceAuthMaterial", () => {    it("returns empty headers for auth.kind none", async () => {      await Effect.runPromise(Effect.gen(function* () {        const auth = yield* resolveSourceAuthMaterialWithDeps({          source: makeSource({            auth: { kind: "none" },          }),          resolveSecretMaterial: () => Effect.die("should not be called"),        });         expect(auth).toEqual({          placements: [],          headers: {},          queryParams: {},          cookies: {},          bodyValues: {},          expiresAt: null,          refreshAfter: null,        });      }));    });     it("resolves bearer auth headers from the configured token ref", async () => {      const calls: string[] = [];       await Effect.runPromise(Effect.gen(function* () {        const auth = yield* resolveSourceAuthMaterialWithDeps({          source: makeSource({            auth: {              kind: "bearer",              headerName: "X-Api-Key",              prefix: "Token ",              token: {                providerId: "local",                handle: "sec_bearer",              },            },          }),          resolveSecretMaterial: ({ ref }) => {            calls.push(`${ref.providerId}:${ref.handle}`);            return Effect.succeed("resolved-bearer-token");          },        });         expect(calls).toEqual(["local:sec_bearer"]);        expect(auth).toEqual({          placements: [            {              location: "header",              name: "X-Api-Key",              value: "Token resolved-bearer-token",            },          ],          headers: {            "X-Api-Key": "Token resolved-bearer-token",          },          queryParams: {},          cookies: {},          bodyValues: {},          expiresAt: null,          refreshAfter: null,        });      }));    });     it("uses the oauth access token ref and ignores the refresh token", async () => {      const calls: string[] = [];       await Effect.runPromise(Effect.gen(function* () {        const auth = yield* resolveSourceAuthMaterialWithDeps({          source: makeSource({            kind: "graphql",            endpoint: "https://example.com/graphql",            binding: {              defaultHeaders: null,            },            auth: {              kind: "oauth2",              headerName: "Authorization",              prefix: "Bearer ",              accessToken: {                providerId: "local",                handle: "sec_access",              },              refreshToken: {                providerId: "local",                handle: "sec_refresh",              },            },          }),          resolveSecretMaterial: ({ ref }) => {            calls.push(`${ref.providerId}:${ref.handle}`);            return Effect.succeed("resolved-access-token");          },        });         expect(calls).toEqual(["local:sec_access"]);        expect(auth).toEqual({          placements: [            {              location: "header",              name: "Authorization",              value: "Bearer resolved-access-token",            },          ],          headers: {            Authorization: "Bearer resolved-access-token",          },          queryParams: {},          cookies: {},          bodyValues: {},          expiresAt: null,          refreshAfter: null,        });      }));    });     it("reconstructs persisted MCP OAuth auth providers from stored auth artifacts", async () => {      const calls: string[] = [];       await Effect.runPromise(Effect.gen(function* () {        const auth = yield* resolveSourceAuthMaterialWithDeps({          source: makeSource({            kind: "mcp",            endpoint: "https://example.com/mcp",            binding: {              transport: "streamable-http",              queryParams: null,              headers: null,            },            auth: { kind: "none" },          }),          actorAccountId: null,          rows: {            authArtifacts: {              getByWorkspaceSourceAndActor: () =>                Effect.succeed(                  Option.some({                    id: AuthArtifactIdSchema.make("auth_artifact_mcp"),                    workspaceId: WorkspaceIdSchema.make("ws_tool_artifacts"),                    sourceId: SourceIdSchema.make("src_tool_artifacts"),                    actorAccountId: null,                    slot: "runtime",                    artifactKind: "mcp_oauth",                    configJson: JSON.stringify({                      redirectUri: "http://127.0.0.1/oauth/callback",                      accessToken: {                        providerId: "local",                        handle: "sec_mcp_access",                      },                      refreshToken: {                        providerId: "local",                        handle: "sec_mcp_refresh",                      },                      tokenType: "Bearer",                      expiresIn: 3600,                      scope: "mcp",                      resourceMetadataUrl: "https://example.com/.well-known/oauth-protected-resource",                      authorizationServerUrl: "https://example.com/oauth",                      resourceMetadataJson: JSON.stringify({ resource: "mcp" }),                      authorizationServerMetadataJson: JSON.stringify({                        issuer: "https://example.com/oauth",                        token_endpoint: "https://example.com/oauth/token",                      }),                      clientInformationJson: JSON.stringify({                        client_id: "client-123",                      }),                    }),                    grantSetJson: null,                    createdAt: 1,                    updatedAt: 1,                  }),                ),            },            authLeases: {              getByAuthArtifactId: () => Effect.succeed(Option.none()),            },          } as any,          resolveSecretMaterial: ({ ref }) => {            calls.push(`${ref.providerId}:${ref.handle}`);            return Effect.succeed(              ref.handle === "sec_mcp_access" ? "persisted-access-token" : "persisted-refresh-token",            );          },        });         expect(auth.headers).toEqual({});        expect(auth.authProvider).toBeDefined();         const tokens = yield* Effect.tryPromise({          try: () => auth.authProvider!.tokens(),          catch: (error) =>            error instanceof Error ? error : new Error(String(error)),        });         expect(tokens).toEqual({          access_token: "persisted-access-token",          refresh_token: "persisted-refresh-token",          token_type: "Bearer",          expires_in: 3600,          scope: "mcp",        });        expect(calls).toEqual([          "local:sec_mcp_access",          "local:sec_mcp_refresh",        ]);      }));    });  });});