// Source endpoints — CRUD through HttpApiClient. Complements tenant// isolation tests by exercising add → get → update → remove flows and// the error paths (remove non-existent, remove static, etc.) within a// single org. import { describe, expect, it } from "@effect/vitest";import { Effect } from "effect";import { readFileSync } from "node:fs";import { resolve } from "node:path"; import { ScopeId, SecretId } from "@executor/sdk"; import {  asOrg,  asUser,  testUserOrgScopeId,} from "./__test-harness__/api-harness"; const MINIMAL_OPENAPI_SPEC = JSON.stringify({  openapi: "3.0.0",  info: { title: "Sources API Test", version: "1.0.0" },  paths: {    "/ping": {      get: {        operationId: "ping",        summary: "ping",        responses: { "200": { description: "ok" } },      },    },  },}); // The Cloudflare OpenAPI spec is the biggest real spec we care about:// 16MB, 2700+ operations, thousands of shared schemas. Exercising// addSpec end-to-end on it through the real postgres adapter is the// load-bearing check that any adapter regression (per-row `createMany`,// accidental N+1 reads, transaction snapshots that copy too much) will// show up as a test failure instead of a prod incident.const CLOUDFLARE_SPEC_PATH = resolve(  __dirname,  "../../../../packages/plugins/openapi/fixtures/cloudflare.json",);const CLOUDFLARE_SPEC = readFileSync(CLOUDFLARE_SPEC_PATH, "utf-8"); describe("sources api (HTTP)", () => {  it.effect("addSpec → sources.list includes the new namespace", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const namespace = `ns_${crypto.randomUUID().replace(/-/g, "_")}`;       yield* asOrg(org, (client) =>        Effect.gen(function* () {          const result = yield* client.openapi.addSpec({            path: { scopeId: ScopeId.make(org) },            payload: { spec: MINIMAL_OPENAPI_SPEC, namespace },          });          expect(result.namespace).toBe(namespace);          expect(result.toolCount).toBeGreaterThan(0);        }),      );       const sources = yield* asOrg(org, (client) =>        client.sources.list({ path: { scopeId: ScopeId.make(org) } }),      );      expect(sources.map((s) => s.id)).toContain(namespace);    }),  );   it.effect("openapi.getSource returns the stored source after addSpec", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const namespace = `ns_${crypto.randomUUID().replace(/-/g, "_")}`;       yield* asOrg(org, (client) =>        client.openapi.addSpec({          path: { scopeId: ScopeId.make(org) },          payload: { spec: MINIMAL_OPENAPI_SPEC, namespace },        }),      );       const fetched = yield* asOrg(org, (client) =>        client.openapi.getSource({ path: { scopeId: ScopeId.make(org), namespace } }),      );      expect(fetched).not.toBeNull();      expect(fetched?.namespace).toBe(namespace);    }),  );   it.effect("sources.remove deletes the source and it drops off sources.list", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const namespace = `ns_${crypto.randomUUID().replace(/-/g, "_")}`;       yield* asOrg(org, (client) =>        Effect.gen(function* () {          yield* client.openapi.addSpec({            path: { scopeId: ScopeId.make(org) },            payload: { spec: MINIMAL_OPENAPI_SPEC, namespace },          });          yield* client.sources.remove({            path: { scopeId: ScopeId.make(org), sourceId: namespace },          });        }),      );       const after = yield* asOrg(org, (client) =>        client.sources.list({ path: { scopeId: ScopeId.make(org) } }),      );      expect(after.map((s) => s.id)).not.toContain(namespace);    }),  );   it.effect("sources.remove on a non-existent sourceId is a no-op (idempotent)", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const ghost = `missing_${crypto.randomUUID().slice(0, 8)}`;       const result = yield* asOrg(org, (client) =>        client.sources          .remove({ path: { scopeId: ScopeId.make(org), sourceId: ghost } })          .pipe(Effect.either),      );      expect(result._tag).toBe("Right");    }),  );   it.effect("sources.remove on a static source is rejected", () =>    Effect.gen(function* () {      // `canRemove: false` is reserved for static (plugin-declared)      // sources. The openapi plugin declares one with id "openapi"      // for its control tools.      const org = `org_${crypto.randomUUID()}`;       const result = yield* asOrg(org, (client) =>        client.sources          .remove({ path: { scopeId: ScopeId.make(org), sourceId: "openapi" } })          .pipe(Effect.either),      );      expect(result._tag).toBe("Left");    }),  );   it.effect("openapi.updateSource round-trips baseUrl + name changes", () =>    Effect.gen(function* () {      const org = `org_${crypto.randomUUID()}`;      const namespace = `ns_${crypto.randomUUID().replace(/-/g, "_")}`;       yield* asOrg(org, (client) =>        Effect.gen(function* () {          yield* client.openapi.addSpec({            path: { scopeId: ScopeId.make(org) },            payload: { spec: MINIMAL_OPENAPI_SPEC, namespace },          });          yield* client.openapi.updateSource({            path: { scopeId: ScopeId.make(org), namespace },            payload: { name: "Renamed API", baseUrl: "https://override.example.com" },          });        }),      );       const fetched = yield* asOrg(org, (client) =>        client.openapi.getSource({ path: { scopeId: ScopeId.make(org), namespace } }),      );      expect(fetched?.name).toBe("Renamed API");      expect(fetched?.config.baseUrl).toBe("https://override.example.com");    }),  );   it.effect("per-user source bindings isolate personal credentials over HTTP", () =>    Effect.gen(function* () {      const orgId = `org_${crypto.randomUUID()}`;      const aliceId = `user_${crypto.randomUUID().slice(0, 8)}`;      const bobId = `user_${crypto.randomUUID().slice(0, 8)}`;      const namespace = `ns_${crypto.randomUUID().replace(/-/g, "_")}`;      const aliceScope = testUserOrgScopeId(aliceId, orgId);      const bobScope = testUserOrgScopeId(bobId, orgId);       yield* asOrg(orgId, (client) =>        client.openapi.addSpec({          path: { scopeId: ScopeId.make(orgId) },          payload: {            spec: MINIMAL_OPENAPI_SPEC,            namespace,            headers: {              Authorization: {                kind: "binding",                slot: "auth:personal-token",                prefix: "Bearer ",              },            },          },        }),      );       yield* asUser(aliceId, orgId, (client) =>        Effect.gen(function* () {          yield* client.secrets.set({            path: { scopeId: ScopeId.make(aliceScope) },            payload: {              id: SecretId.make("alice_pat"),              name: "Alice PAT",              value: "alice-secret",            },          });          yield* client.openapi.setSourceBinding({            path: { scopeId: ScopeId.make(aliceScope) },            payload: {              sourceId: namespace,              sourceScope: ScopeId.make(orgId),              scope: ScopeId.make(aliceScope),              slot: "auth:personal-token",              value: {                kind: "secret",                secretId: SecretId.make("alice_pat"),              },            },          });        }),      );       yield* asUser(bobId, orgId, (client) =>        Effect.gen(function* () {          yield* client.secrets.set({            path: { scopeId: ScopeId.make(bobScope) },            payload: {              id: SecretId.make("bob_pat"),              name: "Bob PAT",              value: "bob-secret",            },          });          yield* client.openapi.setSourceBinding({            path: { scopeId: ScopeId.make(bobScope) },            payload: {              sourceId: namespace,              sourceScope: ScopeId.make(orgId),              scope: ScopeId.make(bobScope),              slot: "auth:personal-token",              value: {                kind: "secret",                secretId: SecretId.make("bob_pat"),              },            },          });        }),      );       const aliceBindings = yield* asUser(aliceId, orgId, (client) =>        client.openapi.listSourceBindings({          path: {            scopeId: ScopeId.make(aliceScope),            namespace,            sourceScopeId: ScopeId.make(orgId),          },        }),      );      expect(aliceBindings).toContainEqual(        expect.objectContaining({          scopeId: ScopeId.make(aliceScope),          slot: "auth:personal-token",          value: {            kind: "secret",            secretId: SecretId.make("alice_pat"),          },        }),      );      expect(        aliceBindings.some(          (binding) =>            binding.slot === "auth:personal-token" &&            binding.value.kind === "secret" &&            binding.value.secretId === SecretId.make("bob_pat"),        ),      ).toBe(false);       const bobBindings = yield* asUser(bobId, orgId, (client) =>        client.openapi.listSourceBindings({          path: {            scopeId: ScopeId.make(bobScope),            namespace,            sourceScopeId: ScopeId.make(orgId),          },        }),      );      expect(bobBindings).toContainEqual(        expect.objectContaining({          scopeId: ScopeId.make(bobScope),          slot: "auth:personal-token",          value: {            kind: "secret",            secretId: SecretId.make("bob_pat"),          },        }),      );      expect(        bobBindings.some(          (binding) =>            binding.slot === "auth:personal-token" &&            binding.value.kind === "secret" &&            binding.value.secretId === SecretId.make("alice_pat"),        ),      ).toBe(false);       const sources = yield* asOrg(orgId, (client) =>        client.sources.list({ path: { scopeId: ScopeId.make(orgId) } }),      );      expect(sources.find((source) => source.id === namespace)?.scopeId).toBe(        ScopeId.make(orgId),      );    }),  );   it.effect(    "addSpec persists the full Cloudflare spec through the real adapter",    () =>      Effect.gen(function* () {        const org = `org_${crypto.randomUUID()}`;        const namespace = `ns_${crypto.randomUUID().replace(/-/g, "_")}`;         const result = yield* asOrg(org, (client) =>          client.openapi.addSpec({            path: { scopeId: ScopeId.make(org) },            payload: { spec: CLOUDFLARE_SPEC, namespace },          }),        );        expect(result.namespace).toBe(namespace);        expect(result.toolCount).toBeGreaterThan(1000);         const sources = yield* asOrg(org, (client) =>          client.sources.list({ path: { scopeId: ScopeId.make(org) } }),        );        expect(sources.map((s) => s.id)).toContain(namespace);         // removeSpec on the same size must also land cleanly — catches        // symmetrical regressions on the delete side (e.g. deleteMany        // fanning out to per-row deletes).        yield* asOrg(org, (client) =>          client.sources.remove({            path: { scopeId: ScopeId.make(org), sourceId: namespace },          }),        );        const after = yield* asOrg(org, (client) =>          client.sources.list({ path: { scopeId: ScopeId.make(org) } }),        );        expect(after.map((s) => s.id)).not.toContain(namespace);      }),    // 60s is generous for a correct O(1) write path on local PGlite;    // a per-row regression would take minutes and hit this ceiling    // long before the suite would tolerate it.    { timeout: 60_000 },  );});