// ---------------------------------------------------------------------------// End-to-end test for the OAuth2 `client_credentials` grant on an OpenAPI// source. A spec that declares ONLY a `clientCredentials` flow (no// authorizationCode, no user-interactive popup, no PKCE) mints a completed// Connection through the shared OAuth service; `ctx.connections.accessToken`// then resolves the bearer at invoke time.// --------------------------------------------------------------------------- import { afterEach, expect, layer } from "@effect/vitest";import { Effect, Layer, Schema } from "effect";import { HttpApi, HttpApiBuilder, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi";import { FetchHttpClient, HttpRouter, HttpServer, HttpServerRequest } from "effect/unstable/http";import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer"; import { collectSchemas, createExecutor, definePlugin, makeInMemoryBlobStore, Scope, ScopeId, SecretId, SetSecretInput, type InvokeOptions, type SecretProvider,} from "@executor-js/sdk";import { makeMemoryAdapter } from "@executor-js/storage-core/testing/memory"; import { openApiPlugin } from "./plugin";import { OAuth2Auth } from "./types"; const autoApprove: InvokeOptions = { onElicitation: "accept-all" }; // ---------------------------------------------------------------------------// Test API — single endpoint that echoes the Authorization header.// --------------------------------------------------------------------------- class EchoHeaders extends Schema.Class<EchoHeaders>("EchoHeaders")({ authorization: Schema.optional(Schema.String),}) {} const ItemsGroup = HttpApiGroup.make("items").add( HttpApiEndpoint.get("echoHeaders", "/echo-headers", { success: EchoHeaders }),); const TestApi = HttpApi.make("testApi").add(ItemsGroup);const specJson = JSON.stringify(OpenApi.fromApi(TestApi)); const ItemsGroupLive = HttpApiBuilder.group(TestApi, "items", (handlers) => handlers.handle("echoHeaders", () => Effect.gen(function* () { const req = yield* HttpServerRequest.HttpServerRequest; return new EchoHeaders({ authorization: req.headers["authorization"], }); }), ),); const ApiLive = HttpApiBuilder.layer(TestApi).pipe(Layer.provide(ItemsGroupLive)); const TestLayer = HttpRouter.serve(ApiLive, { disableListenLog: true, disableLogger: true }).pipe( Layer.provideMerge(NodeHttpServer.layerTest),); // ---------------------------------------------------------------------------// Fetch override — records the POST body the plugin sends to the token// endpoint so the test can assert it's a spec-compliant client_credentials// request, and returns a distinct access_token each call.// --------------------------------------------------------------------------- const originalFetch = globalThis.fetch; type TokenCall = { readonly grantType: string | null; readonly clientId: string | null; readonly clientSecret: string | null; readonly scope: string | null;}; const mockClientCredentialsFetch = (args: { readonly calls: TokenCall[]; readonly accessTokens: readonly string[]; readonly expiresIn?: number;}) => { let callIndex = 0; globalThis.fetch = Object.assign(async (_input: RequestInfo | URL, init?: RequestInit) => { const url = typeof _input === "string" ? _input : _input.toString(); if (!url.includes("token.example.com")) { return originalFetch(_input, init); } const bodyText = init?.body instanceof URLSearchParams ? init.body.toString() : typeof init?.body === "string" ? init.body : ""; const params = new URLSearchParams(bodyText); args.calls.push({ grantType: params.get("grant_type"), clientId: params.get("client_id"), clientSecret: params.get("client_secret"), scope: params.get("scope"), }); const token = args.accessTokens[Math.min(callIndex, args.accessTokens.length - 1)] ?? "unknown"; callIndex += 1; const body: Record<string, unknown> = { access_token: token, token_type: "Bearer", }; if (typeof args.expiresIn === "number") body.expires_in = args.expiresIn; return new Response(JSON.stringify(body), { status: 200, headers: { "content-type": "application/json" }, }); }, { preconnect: originalFetch.preconnect });}; afterEach(() => { globalThis.fetch = originalFetch;}); // ---------------------------------------------------------------------------// Tests// --------------------------------------------------------------------------- layer(TestLayer)("OpenAPI client_credentials OAuth", (it) => { it.effect("startOAuth exchanges tokens inline and makes them usable at invoke time", () => Effect.gen(function* () { const secretStore = new Map<string, string>(); const key = (scope: string, id: string) => `${scope}:${id}`; const memoryProvider: SecretProvider = { key: "memory", writable: true, get: (id, scope) => Effect.sync(() => secretStore.get(key(scope, id)) ?? null), set: (id, value, scope) => Effect.sync(() => { secretStore.set(key(scope, id), value); }), delete: (id, scope) => Effect.sync(() => secretStore.delete(key(scope, id))), }; const memorySecretsPlugin = definePlugin(() => ({ id: "memory-secrets" as const, storage: () => ({}), secretProviders: [memoryProvider], })); const clientLayer = FetchHttpClient.layer; const server = yield* HttpServer.HttpServer; const address = server.address; if (address._tag !== "TcpAddress") return yield* Effect.die("test server must bind to TCP"); const baseUrl = `http://127.0.0.1:${address.port}`; const plugins = [ openApiPlugin({ httpClientLayer: clientLayer }), memorySecretsPlugin(), ] as const; const schema = collectSchemas(plugins); const adapter = makeMemoryAdapter({ schema }); const blobs = makeInMemoryBlobStore(); const now = new Date(); const orgScope = new Scope({ id: ScopeId.make("org"), name: "acme-org", createdAt: now, }); const userScope = new Scope({ id: ScopeId.make("user-alice"), name: "alice", createdAt: now, }); const adminExec = yield* createExecutor({ scopes: [orgScope], adapter, blobs, plugins, onElicitation: "accept-all", }); const userExec = yield* createExecutor({ scopes: [userScope, orgScope], adapter, blobs, plugins, onElicitation: "accept-all", }); // Admin seeds the shared client_id + client_secret at the org. yield* adminExec.secrets.set( new SetSecretInput({ id: SecretId.make("petstore_client_id"), scope: orgScope.id, name: "Petstore Client ID", value: "client-abc", }), ); yield* adminExec.secrets.set( new SetSecretInput({ id: SecretId.make("petstore_client_secret"), scope: orgScope.id, name: "Petstore Client Secret", value: "secret-xyz", }), ); const calls: TokenCall[] = []; mockClientCredentialsFetch({ calls, accessTokens: ["alice-token-1"], }); // ------------------------------------------------------------ // Shared OAuth start for clientCredentials: no authorizationUrl, // no popup, no complete. The OAuth service exchanges tokens // inline and creates the Connection. // ------------------------------------------------------------ const connectionId = "openapi-oauth2-app-petstore"; const started = yield* userExec.oauth.start({ endpoint: "https://token.example.com/token", redirectUrl: "https://token.example.com/token", connectionId, tokenScope: String(userScope.id), pluginId: "openapi", identityLabel: "Petstore OAuth", strategy: { kind: "client-credentials", tokenEndpoint: "https://token.example.com/token", clientIdSecretId: "petstore_client_id", clientSecretSecretId: "petstore_client_secret", scopes: ["data"], }, }); if (!started.completedConnection) { throw new Error("expected completed clientCredentials connection"); } const auth = new OAuth2Auth({ kind: "oauth2", connectionId: started.completedConnection.connectionId, securitySchemeName: "oauth2", flow: "clientCredentials", tokenUrl: "https://token.example.com/token", authorizationUrl: null, clientIdSecretId: "petstore_client_id", clientSecretSecretId: "petstore_client_secret", scopes: ["data"], }); expect(auth.connectionId).toBe(connectionId); // Token endpoint call is RFC 6749 §4.4 compliant. expect(calls).toHaveLength(1); expect(calls[0]!.grantType).toBe("client_credentials"); expect(calls[0]!.clientId).toBe("client-abc"); expect(calls[0]!.clientSecret).toBe("secret-xyz"); expect(calls[0]!.scope).toBe("data"); // Add the source with OAuth2Auth pointing at the completed connection. yield* userExec.openapi.addSpec({ spec: specJson, scope: userScope.id as string, namespace: "petstore", baseUrl, oauth2: auth, }); // Invoking the tool injects the freshly-minted bearer via // ctx.connections.accessToken. const result = (yield* userExec.tools.invoke( "petstore.items.echoHeaders", {}, autoApprove, )) as { data: { authorization?: string } | null; error: unknown; }; expect(result.error).toBeNull(); expect(result.data?.authorization).toBe("Bearer alice-token-1"); // The connection lives at the innermost (user) scope, which // preserves per-user credential resolution: if each user has // their own `dealcloud_client_id`/`dealcloud_client_secret` // shadowed at their user scope, each user mints their own // token. A single shared `oauth2.connectionId` *name* still // lets every caller reach the right physical row via // `findInnermostConnectionRow`. const userConnections = yield* userExec.connections.list(); const connection = userConnections.find((c) => c.id === auth.connectionId); expect(connection).toBeDefined(); expect(String(connection?.scopeId)).toBe("user-alice"); expect(connection?.provider).toBe("oauth2"); // Stable id derived from sourceId — no UUID-per-click churn. expect(auth.connectionId).toBe("openapi-oauth2-app-petstore"); // Access-token secret is owned by the connection and filtered // out of the user-facing secret list. const userSecretIds = new Set( (yield* userExec.secrets.list()).map((s) => String(s.id)), ); expect(userSecretIds).toContain("petstore_client_id"); expect(userSecretIds).toContain("petstore_client_secret"); expect(userSecretIds).not.toContain(`${auth.connectionId}.access_token`); // Admin scope sees neither alice's connection nor her token. const adminSecretIds = new Set( (yield* adminExec.secrets.list()).map((s) => String(s.id)), ); expect(adminSecretIds).not.toContain(`${auth.connectionId}.access_token`); }), );});
// ---------------------------------------------------------------------------
// End-to-end test for the OAuth2 `client_credentials` grant on an OpenAPI
// source. A spec that declares ONLY a `clientCredentials` flow (no
// authorizationCode, no user-interactive popup, no PKCE) mints a completed
// Connection through the shared OAuth service; `ctx.connections.accessToken`
// then resolves the bearer at invoke time.
// ---------------------------------------------------------------------------
import { afterEach, expect, layer } from "@effect/vitest";
import { Effect, Layer, Schema } from "effect";
import { HttpApi, HttpApiBuilder, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi";
import { FetchHttpClient, HttpRouter, HttpServer, HttpServerRequest } from "effect/unstable/http";
import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
import {
collectSchemas,
createExecutor,
definePlugin,
makeInMemoryBlobStore,
Scope,
ScopeId,
SecretId,
SetSecretInput,
type InvokeOptions,
type SecretProvider,
} from "@executor-js/sdk";
import { makeMemoryAdapter } from "@executor-js/storage-core/testing/memory";
import { openApiPlugin } from "./plugin";
import { OAuth2Auth } from "./types";
const autoApprove: InvokeOptions = { onElicitation: "accept-all" };
// ---------------------------------------------------------------------------
// Test API — single endpoint that echoes the Authorization header.
// ---------------------------------------------------------------------------
class EchoHeaders extends Schema.Class<EchoHeaders>("EchoHeaders")({
authorization: Schema.optional(Schema.String),
}) {}
const ItemsGroup = HttpApiGroup.make("items").add(
HttpApiEndpoint.get("echoHeaders", "/echo-headers", { success: EchoHeaders }),
);
const TestApi = HttpApi.make("testApi").add(ItemsGroup);
const specJson = JSON.stringify(OpenApi.fromApi(TestApi));
const ItemsGroupLive = HttpApiBuilder.group(TestApi, "items", (handlers) =>
handlers.handle("echoHeaders", () =>
Effect.gen(function* () {
const req = yield* HttpServerRequest.HttpServerRequest;
return new EchoHeaders({
authorization: req.headers["authorization"],
});
}),
),
);
const ApiLive = HttpApiBuilder.layer(TestApi).pipe(Layer.provide(ItemsGroupLive));
const TestLayer = HttpRouter.serve(ApiLive, { disableListenLog: true, disableLogger: true }).pipe(
Layer.provideMerge(NodeHttpServer.layerTest),
);
// ---------------------------------------------------------------------------
// Fetch override — records the POST body the plugin sends to the token
// endpoint so the test can assert it's a spec-compliant client_credentials
// request, and returns a distinct access_token each call.
// ---------------------------------------------------------------------------
const originalFetch = globalThis.fetch;
type TokenCall = {
readonly grantType: string | null;
readonly clientId: string | null;
readonly clientSecret: string | null;
readonly scope: string | null;
};
const mockClientCredentialsFetch = (args: {
readonly calls: TokenCall[];
readonly accessTokens: readonly string[];
readonly expiresIn?: number;
}) => {
let callIndex = 0;
globalThis.fetch = Object.assign(async (_input: RequestInfo | URL, init?: RequestInit) => {
const url = typeof _input === "string" ? _input : _input.toString();
if (!url.includes("token.example.com")) {
return originalFetch(_input, init);
}
const bodyText =
init?.body instanceof URLSearchParams
? init.body.toString()
: typeof init?.body === "string"
? init.body
: "";
const params = new URLSearchParams(bodyText);
args.calls.push({
grantType: params.get("grant_type"),
clientId: params.get("client_id"),
clientSecret: params.get("client_secret"),
scope: params.get("scope"),
});
const token = args.accessTokens[Math.min(callIndex, args.accessTokens.length - 1)] ?? "unknown";
callIndex += 1;
const body: Record<string, unknown> = {
access_token: token,
token_type: "Bearer",
};
if (typeof args.expiresIn === "number") body.expires_in = args.expiresIn;
return new Response(JSON.stringify(body), {
status: 200,
headers: { "content-type": "application/json" },
});
}, { preconnect: originalFetch.preconnect });
};
afterEach(() => {
globalThis.fetch = originalFetch;
});
// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------
layer(TestLayer)("OpenAPI client_credentials OAuth", (it) => {
it.effect("startOAuth exchanges tokens inline and makes them usable at invoke time", () =>
Effect.gen(function* () {
const secretStore = new Map<string, string>();
const key = (scope: string, id: string) => `${scope}:${id}`;
const memoryProvider: SecretProvider = {
key: "memory",
writable: true,
get: (id, scope) => Effect.sync(() => secretStore.get(key(scope, id)) ?? null),
set: (id, value, scope) =>
Effect.sync(() => {
secretStore.set(key(scope, id), value);
}),
delete: (id, scope) => Effect.sync(() => secretStore.delete(key(scope, id))),
};
const memorySecretsPlugin = definePlugin(() => ({
id: "memory-secrets" as const,
storage: () => ({}),
secretProviders: [memoryProvider],
}));
const clientLayer = FetchHttpClient.layer;
const server = yield* HttpServer.HttpServer;
const address = server.address;
if (address._tag !== "TcpAddress") return yield* Effect.die("test server must bind to TCP");
const baseUrl = `http://127.0.0.1:${address.port}`;
const plugins = [
openApiPlugin({ httpClientLayer: clientLayer }),
memorySecretsPlugin(),
] as const;
const schema = collectSchemas(plugins);
const adapter = makeMemoryAdapter({ schema });
const blobs = makeInMemoryBlobStore();
const now = new Date();
const orgScope = new Scope({
id: ScopeId.make("org"),
name: "acme-org",
createdAt: now,
});
const userScope = new Scope({
id: ScopeId.make("user-alice"),
name: "alice",
createdAt: now,
});
const adminExec = yield* createExecutor({
scopes: [orgScope],
adapter,
blobs,
plugins,
onElicitation: "accept-all",
});
const userExec = yield* createExecutor({
scopes: [userScope, orgScope],
adapter,
blobs,
plugins,
onElicitation: "accept-all",
});
// Admin seeds the shared client_id + client_secret at the org.
yield* adminExec.secrets.set(
new SetSecretInput({
id: SecretId.make("petstore_client_id"),
scope: orgScope.id,
name: "Petstore Client ID",
value: "client-abc",
}),
);
yield* adminExec.secrets.set(
new SetSecretInput({
id: SecretId.make("petstore_client_secret"),
scope: orgScope.id,
name: "Petstore Client Secret",
value: "secret-xyz",
}),
);
const calls: TokenCall[] = [];
mockClientCredentialsFetch({
calls,
accessTokens: ["alice-token-1"],
});
// ------------------------------------------------------------
// Shared OAuth start for clientCredentials: no authorizationUrl,
// no popup, no complete. The OAuth service exchanges tokens
// inline and creates the Connection.
// ------------------------------------------------------------
const connectionId = "openapi-oauth2-app-petstore";
const started = yield* userExec.oauth.start({
endpoint: "https://token.example.com/token",
redirectUrl: "https://token.example.com/token",
connectionId,
tokenScope: String(userScope.id),
pluginId: "openapi",
identityLabel: "Petstore OAuth",
strategy: {
kind: "client-credentials",
tokenEndpoint: "https://token.example.com/token",
clientIdSecretId: "petstore_client_id",
clientSecretSecretId: "petstore_client_secret",
scopes: ["data"],
},
});
if (!started.completedConnection) {
throw new Error("expected completed clientCredentials connection");
}
const auth = new OAuth2Auth({
kind: "oauth2",
connectionId: started.completedConnection.connectionId,
securitySchemeName: "oauth2",
flow: "clientCredentials",
tokenUrl: "https://token.example.com/token",
authorizationUrl: null,
clientIdSecretId: "petstore_client_id",
clientSecretSecretId: "petstore_client_secret",
scopes: ["data"],
});
expect(auth.connectionId).toBe(connectionId);
// Token endpoint call is RFC 6749 §4.4 compliant.
expect(calls).toHaveLength(1);
expect(calls[0]!.grantType).toBe("client_credentials");
expect(calls[0]!.clientId).toBe("client-abc");
expect(calls[0]!.clientSecret).toBe("secret-xyz");
expect(calls[0]!.scope).toBe("data");
// Add the source with OAuth2Auth pointing at the completed connection.
yield* userExec.openapi.addSpec({
spec: specJson,
scope: userScope.id as string,
namespace: "petstore",
baseUrl,
oauth2: auth,
});
// Invoking the tool injects the freshly-minted bearer via
// ctx.connections.accessToken.
const result = (yield* userExec.tools.invoke(
"petstore.items.echoHeaders",
{},
autoApprove,
)) as {
data: { authorization?: string } | null;
error: unknown;
};
expect(result.error).toBeNull();
expect(result.data?.authorization).toBe("Bearer alice-token-1");
// The connection lives at the innermost (user) scope, which
// preserves per-user credential resolution: if each user has
// their own `dealcloud_client_id`/`dealcloud_client_secret`
// shadowed at their user scope, each user mints their own
// token. A single shared `oauth2.connectionId` *name* still
// lets every caller reach the right physical row via
// `findInnermostConnectionRow`.
const userConnections = yield* userExec.connections.list();
const connection = userConnections.find((c) => c.id === auth.connectionId);
expect(connection).toBeDefined();
expect(String(connection?.scopeId)).toBe("user-alice");
expect(connection?.provider).toBe("oauth2");
// Stable id derived from sourceId — no UUID-per-click churn.
expect(auth.connectionId).toBe("openapi-oauth2-app-petstore");
// Access-token secret is owned by the connection and filtered
// out of the user-facing secret list.
const userSecretIds = new Set(
(yield* userExec.secrets.list()).map((s) => String(s.id)),
);
expect(userSecretIds).toContain("petstore_client_id");
expect(userSecretIds).toContain("petstore_client_secret");
expect(userSecretIds).not.toContain(`${auth.connectionId}.access_token`);
// Admin scope sees neither alice's connection nor her token.
const adminSecretIds = new Set(
(yield* adminExec.secrets.list()).map((s) => String(s.id)),
);
expect(adminSecretIds).not.toContain(`${auth.connectionId}.access_token`);
}),
);
});