Move product access rules out of the SDK

Rhys Sullivan committed 1 month ago

Commit c676e561 parent a72e51d161 files · +3935 −867Browse files

Showing the changes to packages/plugins/openapi/src (15 of 161 files). Show all

Unified · Split

15 files

packages/plugins/openapi/src/providers/google/spec-format-adapter.test.ts +4 −0
packages/plugins/openapi/src/sdk/configure.test.ts +25 −8
packages/plugins/openapi/src/sdk/form-urlencoded-body.test.ts +22 −23
packages/plugins/openapi/src/sdk/health-check-redaction.test.ts +2 −0
packages/plugins/openapi/src/sdk/multi-scope-bearer.test.ts +4 −1
packages/plugins/openapi/src/sdk/non-json-body.test.ts +106 −35
packages/plugins/openapi/src/sdk/plugin.test.ts +104 −35
packages/plugins/openapi/src/sdk/real-specs.test.ts +2 −0
packages/plugins/openapi/src/sdk/response-body-timeout.test.ts +4 −1
packages/plugins/openapi/src/sdk/response-headers-timeout.test.ts +4 −1
packages/plugins/openapi/src/sdk/spec-blob.test.ts +15 −6
packages/plugins/openapi/src/sdk/spec-overrides-lifecycle.test.ts +10 −3
packages/plugins/openapi/src/sdk/streaming-response.test.ts +7 −2
packages/plugins/openapi/src/sdk/tool-row-projection.test.ts +4 −1
packages/plugins/openapi/src/sdk/upstream-failures.test.ts +8 −3

packages/plugins/openapi/src/providers/google/spec-format-adapter.test.ts+4−0

 import { deriveGoogleDiscoveryIdentity, googleDiscoveryAdapter } from "./spec-format-adapter";
 import { googleCatalog } from "./presets";
+import { testAccess } from "@executor-js/product-access/testing";
 const TASKS_URL = "https://www.googleapis.com/discovery/v1/apis/tasks/v1/rest";
 const GMAIL_URL = "https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest";
   Effect.gen(function* () {
     const executor = yield* createExecutor(
       makeTestConfig({
+        access: testAccess.member(),
         plugins: [
           openApiPlugin({
             httpClientLayer: discoveryHttpClientLayer,
       );
       const executor = yield* createExecutor(
         makeTestConfig({
+          access: testAccess.member(),
           plugins: [
             openApiPlugin({
               httpClientLayer: discoveryHttpClientLayer,
     );
     const executor = yield* createExecutor(
       makeTestConfig({
+        access: testAccess.member(),
         plugins: [
           openApiPlugin({
             httpClientLayer: gmailDiscoveryHttpClientLayer,

packages/plugins/openapi/src/sdk/configure.test.ts+25−8

   serveOpenApiHttpApiTestServer,
   unwrapInvocation,
 } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const testPlugins = (httpClientLayer = FetchHttpClient.layer) =>
   [openApiPlugin({ httpClientLayer }), memoryCredentialsPlugin()] as const;
   it.effect("adds a custom apiKey method and getConfig reflects it", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: specText() },
   it.effect("appends to an existing spec-derived template without dropping entries", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const seedTemplate: AuthenticationInput = {
           slug: "seed",
   it.effect("generates a custom_<id> slug for a method submitted without one", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: specText() },
   it.effect("dedupes: a matching slug replaces in place; two slugless get distinct slugs", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: specText() },
   it.effect("replace mode overwrites the auth template array", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const seedTemplate: AuthenticationInput = {
           slug: "seed",
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: server.specJson },
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: server.specJson },
   it.effect("getConfig returns null for an unknown integration", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         expect(yield* executor.openapi.getConfig("nope")).toBeNull();
       }),
     ),

packages/plugins/openapi/src/sdk/form-urlencoded-body.test.ts+22−23

@@ -30,6 +30,7 @@ import { · 29 unmodified lines
30	} from "@executor-js/plugin-openapi/testing";	30	} from "@executor-js/plugin-openapi/testing";
31		31
32	import { openApiPlugin } from "./plugin";	32	import { openApiPlugin } from "./plugin";
		33	import { testAccess } from "@executor-js/product-access/testing";
33		34
34	type Captured = {	35	type Captured = {
35	contentType: string;	36	contentType: string;
@@ -76,30 +77,28 @@ const plugins = [ · 40 unmodified lines
76	memoryCredentialsPlugin(),	77	memoryCredentialsPlugin(),
77	] as const;	78	] as const;
78		79
79	layer(	80	layer(makeTestWorkspaceLayer({ access: testAccess.member(), plugins }), { timeout: "15 seconds" })(
80	makeTestWorkspaceLayer({	81	"OpenAPI non-JSON request body serialization",
81	plugins,	82	(it) => {
82	}),	83	it.effect("form-urlencoded object body is properly encoded (no '[object Object]')", () =>
83	{ timeout: "15 seconds" },	84	Effect.gen(function* () {
84	)("OpenAPI non-JSON request body serialization", (it) => {	85	const { server, captured } = yield* startEchoServer();
85	it.effect("form-urlencoded object body is properly encoded (no '[object Object]')", () =>	86	const { config } = yield* TestWorkspace;
86	Effect.gen(function* () {	87	const executor = yield* createExecutor({ ...config, plugins });
87	const { server, captured } = yield* startEchoServer();
88	const { config } = yield* TestWorkspace;
89	const executor = yield* createExecutor({ ...config, plugins });
90		88
91	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "form" });	89	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "form" });
92		90
93	yield* executor.execute(conn.address("forms.submit"), {	91	yield* executor.execute(conn.address("forms.submit"), {
94	body: { name: "Acme", email: "a@b.com" },	92	body: { name: "Acme", email: "a@b.com" },
95	});	93	});
96		94
97	expect(captured.contentType).toBe("application/x-www-form-urlencoded");	95	expect(captured.contentType).toBe("application/x-www-form-urlencoded");
98	expect(captured.body).not.toBe("[object Object]");	96	expect(captured.body).not.toBe("[object Object]");
99		97
100	const parsed = new URLSearchParams(captured.body);	98	const parsed = new URLSearchParams(captured.body);
101	expect(parsed.get("name")).toBe("Acme");	99	expect(parsed.get("name")).toBe("Acme");
102	expect(parsed.get("email")).toBe("a@b.com");	100	expect(parsed.get("email")).toBe("a@b.com");
103	}),	101	}),
104	);	102	);
105	});	103	},
		104	);

packages/plugins/openapi/src/sdk/health-check-redaction.test.ts+2−0

 import { serveOpenApiHttpApiTestServer } from "../testing";
 import { openApiPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 /** The credential the connection authenticates with. Longer than the sample's
  *  120-char value cap on purpose: truncating before scrubbing would leave a
     });
     const executor = yield* createExecutor(
       makeTestConfig({
+        access: testAccess.member(),
         plugins: [
           openApiPlugin({ httpClientLayer: FetchHttpClient.layer }),
           memoryCredentialsPlugin(),

packages/plugins/openapi/src/sdk/multi-scope-bearer.test.ts+4−1

 import { openApiPlugin } from "./plugin";
 import { type AuthenticationInput } from "./types";
+import { testAccess } from "@executor-js/product-access/testing";
 // ---------------------------------------------------------------------------
 // Test API — a single endpoint that echoes the Authorization header so the
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* serveVercel();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         // Admin uploads the spec once; the integration declares a bearer
         // template but no token value.

packages/plugins/openapi/src/sdk/non-json-body.test.ts+106−35

 } from "@executor-js/plugin-openapi/testing";
 import { openApiPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 const JsonNameBody = Schema.fromJsonString(
   Schema.Struct({
         payload: ObjectBody.pipe(HttpApiSchema.asMultipart()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mp" });
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "paperless" });
       const schema = yield* executor.tools.schema(conn.address("body.upload"));
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "pages" });
       const schema = yield* executor.tools.schema(conn.address("body.uploadPages"));
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "broken" });
       const exit = yield* executor
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "notes" });
       // The rewrite is scoped to multipart bodies: a JSON body keeps its
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "notes-jsonapi" });
       yield* executor.execute(conn.address("body.createNote"), {
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mixed" });
       const schema = yield* executor.tools.schema(conn.address("body.uploadMixed"));
         },
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "reffed" });
       // Documented limitation: component schemas are carried through
         payload: Schema.String.pipe(HttpApiSchema.asText({ contentType: "application/xml" })),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "xml" });
         transformSpec: replaceRequestBodyContent("/submit", "post", contentFor("text/xml")),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "tx" });
         payload: Schema.String.pipe(HttpApiSchema.asText()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "tp" });
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin" });
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin_b64" });
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin_b64_bad" });
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, {
         slug: "bin_nested_b64_bad",
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, {
         slug: "bin_b64_missing",
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, {
         slug: "bin_object_body",
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, {
         slug: "bin_string_body",
           }),
         });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "gmail" });
         const schema = yield* executor.tools.schema(conn.address("gmail.getAttachment"));
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "gmail_text" });
       const result = yield* executor.execute(conn.address("gmailText.getAttachment"), {
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "zip_attachment" });
       const result = yield* executor.execute(conn.address("zipAttachment.getAttachment"), {
           ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "gmail_meta" });
       const result = yield* executor.execute(conn.address("gmailMeta.getAttachment"), {
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "files" });
       const schema = yield* executor.tools.schema(conn.address("files.download"));
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "files" });
       const result = yield* executor.execute(conn.address("files.download"), {
         payload: multiContentPayload,
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc" });
         payload: multiContentPayload,
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc2" });
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc_b64" });
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc_b64_bad_ct" });
           },
         }),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc_b64_schema" });
       const { server } = yield* startEchoServer({
         payload: multiContentPayload,
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, {
         slug: "mc3",
       const { server } = yield* startEchoServer({
         payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin_schema" });
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mpe" });
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "fe" });
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "fd" });
         ),
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       // No encoding → OAS3 defaults: style=form, explode=true.
       const conn = yield* addOpenApiTestConnection(executor, server, { slug: "fdx" });

packages/plugins/openapi/src/sdk/plugin.test.ts+104−35

   serveOpenApiHttpApiTestServer,
   unwrapInvocation,
 } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const TOOL_ERROR_TYPESCRIPT =
   "{ code: string; message: string; status?: number; details?: unknown; retryable?: boolean }";
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const preview = yield* executor.openapi.previewSpec(server.specJson);
       Effect.gen(function* () {
         const server = yield* serveOAuthDiscoverableOpenApiSpec();
         const executor = yield* createExecutor(
-          makeTestConfig({ plugins: testPlugins(server.httpClientLayer) }),
+          makeTestConfig({
+            access: testAccess.member(),
+            plugins: testPlugins(server.httpClientLayer),
+          }),
         );
         const preview = yield* executor.openapi.previewSpec(server.url("/api/schema/"));
   it.effect("exposes static openapi executor control tools via execute", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       // v2: static control tools are NOT part of `tools.list()` (that's the
       // persisted per-connection catalog) and aren't `tools.schema()`-resolvable;
   it.effect("invokes static previewSpec through executor.execute", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const preview = unwrapInvocation(
         yield* executor.execute(ToolAddress.make("executor.openapi.previewSpec"), {
   it.effect("invokes static addSpec through executor.execute", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const result = unwrapInvocation(
         yield* executor.execute(ToolAddress.make("executor.openapi.addSpec"), {
     Effect.scoped(
       Effect.gen(function* () {
         const specServer = yield* serveMutableOpenApiSpecTestServer({ initialApi: TestApi });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "url", url: specServer.specUrl },
   it.effect("static previewSpec returns actionable tool failures", () =>
     Effect.gen(function* () {
-      const config = makeTestConfig({ plugins: [openApiPlugin()] as const });
+      const config = makeTestConfig({
+        access: testAccess.member(),
+        plugins: [openApiPlugin()] as const,
+      });
       const executor = yield* createExecutor(config);
       const result = yield* executor.execute(ToolAddress.make("executor.openapi.previewSpec"), {
   it.effect("requires approval before adding an integration through the runtime tool", () =>
     Effect.gen(function* () {
       const executor = yield* createExecutor(
-        makeTestConfig({ plugins: [openApiPlugin()] as const }),
+        makeTestConfig({ access: testAccess.member(), plugins: [openApiPlugin()] as const }),
       );
       const declined = yield* executor
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
         const calls = { count: 0 };
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
         const calls = { count: 0 };
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
         const calls = { count: 0 };
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
         const calls = { count: 0 };
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
         const failure = yield* executor
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const multiServer = {
           ...server,
           specJson: makeOpenApiTestSpecJson(TestApi, {
         const server = yield* serveOpenApiEchoTestServer({
           transformSpec: withEchoCookieParameter,
         });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, {
           slug: "cookie_params",
           headers: { Cookie: "configured=yes" },
         const server = yield* serveOpenApiEchoTestServer({
           transformSpec: withEchoCookieParameter,
         });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, {
           slug: "cookie_unknown",
         });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const conn = yield* addOpenApiTestConnection(executor, server, { slug: "records" });
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: server.specJson },
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: server.specJson },
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         // The spec declares bearer auth; the caller passes NO template — the
         // agentic add path (MCP/API) does exactly this. Without server-side
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         // No baseUrl override: the spec declares `servers`, so the host is
         // resolved per call from the operation's servers rather than baked into
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         // The add page sends [] when the user deletes every detected method.
         // That intent must survive — deriving methods back from the spec here
   it.effect("addSpec accepts Graph-sized OpenAPI blobs", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const largeDescription = "x".repeat(36 * 1024 * 1024);
       const added = yield* executor.openapi.addSpec({
     "addSpec accepts Microsoft Graph-scale operation catalogs from one spec",
     () =>
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const added = yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: microsoftGraphScaleSpecText() },
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* addOpenApiTestConnection(executor, server, { slug: "removable" });
         expect((yield* executor.tools.list()).map((t) => String(t.name))).toContain(
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         // First add carries an apiKey auth template + a distinctive description.
         // A silent upsert on re-add would clobber both.
         // The mutable spec server is a real 127.0.0.1 listener — reach it over
         // the default fetch-based client, like production would.
         const specServer = yield* serveMutableOpenApiSpecTestServer({ initialApi: TestApi });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const added = yield* executor.openapi.addSpec({
           spec: { kind: "url", url: specServer.specUrl },
   it.effect("denies member updateSpec before writing an org blob", () =>
     Effect.gen(function* () {
       const blobs = recordingBlobStore();
-      const config = makeTestConfig({ plugins: testPlugins() });
+      const config = makeTestConfig({ access: testAccess.member(), plugins: testPlugins() });
       const admin = yield* createExecutor({ ...config, blobs: blobs.store });
       yield* admin.openapi.addSpec({
         spec: { kind: "blob", value: testApiSpecText() },
       const member = yield* createExecutor({
         ...config,
         blobs: blobs.store,
-        orgWrites: "denied",
+        access: testAccess.member("denied"),
       });
       const error = yield* member.openapi
     Effect.scoped(
       Effect.gen(function* () {
         const server = yield* servePluginTestApi();
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* addOpenApiTestConnection(executor, server, { slug: "pasted" });
         // A pasted-blob integration has no source URL — re-fetch must say so.
         const plugins = testPlugins();
         const alice = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "alice",
         });
         const bob = yield* makeTestWorkspaceHarness({
+          access: testAccess.member(),
           plugins,
           tenant,
           subject: "bob",
   it.effect("updateSpec on an unknown slug fails with IntegrationNotFoundError", () =>
     Effect.gen(function* () {
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       const error = yield* executor.openapi.updateSpec("missing").pipe(Effect.flip);
       expect(Predicate.isTagged(error, "IntegrationNotFoundError")).toBe(true);
     }),

packages/plugins/openapi/src/sdk/real-specs.test.ts+2−0

 import { deriveAuthenticationTemplateFromPreview } from "./derive-auth";
 import { previewSpec as previewSpecRaw } from "./preview";
 import type { ExtractionResult } from "./types";
+import { testAccess } from "@executor-js/product-access/testing";
 const previewSpec = (input: string) =>
   previewSpecRaw(input).pipe(Effect.provide(FetchHttpClient.layer));
     const executor = yield* createExecutor(
       makeTestConfig({
+        access: testAccess.member(),
         plugins: [openApiPlugin(), memoryCredentialsPlugin()] as const,
       }),
     );

packages/plugins/openapi/src/sdk/response-body-timeout.test.ts+4−1

 import { makeOpenApiHttpApiTestIntegrationConfig } from "../testing";
 import { openApiPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 const BODY_READ_DEADLINE_MS = 15_000;
 const RESPONSE_BODY_TIMEOUT_MS = 100;
 const buildExecutor = (baseUrl: string) =>
   Effect.gen(function* () {
-    const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+    const executor = yield* createExecutor(
+      makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+    );
     yield* executor.openapi.addSpec(
       makeOpenApiHttpApiTestIntegrationConfig(TimeoutApi, {
         slug: "body_timeout",

packages/plugins/openapi/src/sdk/response-headers-timeout.test.ts+4−1

 import { invokeWithLayer } from "./invoke";
 import { openApiPlugin } from "./plugin";
 import type { OperationBinding } from "./types";
+import { testAccess } from "@executor-js/product-access/testing";
 const RESPONSE_HEADERS_TIMEOUT_MS = 100;
 const STREAM_TOOL = "logs.getLogs";
 const buildExecutor = (baseUrl: string) =>
   Effect.gen(function* () {
-    const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+    const executor = yield* createExecutor(
+      makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+    );
     yield* executor.openapi.addSpec(
       makeOpenApiHttpApiTestIntegrationConfig(TimeoutApi, { slug: "headers_timeout", baseUrl }),
     );

packages/plugins/openapi/src/sdk/spec-blob.test.ts+15−6

   serveOpenApiHttpApiTestServer,
   unwrapInvocation,
 } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const testPlugins = (httpClientLayer = FetchHttpClient.layer) =>
   [openApiPlugin({ httpClientLayer }), memoryCredentialsPlugin()] as const;
   it.effect("addSpec stores a content pointer, not the inline spec text", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const text = specText();
         yield* executor.openapi.addSpec({
           api: TestApi,
           handlersLayer: EchoGroupLive,
         });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: server.specJson },
     () =>
       Effect.scoped(
         Effect.gen(function* () {
-          const config = makeTestConfig({ plugins: testPlugins() });
+          const config = makeTestConfig({ access: testAccess.member(), plugins: testPlugins() });
           const executor = yield* createExecutor(config);
           const text = specTextWithDefinition();
           const hash = yield* sha256Hex(text);
   it.effect("stale sync preserves tools and definitions when the spec blob is missing", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const config = makeTestConfig({ plugins: testPlugins() });
+        const config = makeTestConfig({ access: testAccess.member(), plugins: testPlugins() });
         const executor = yield* createExecutor(config);
         const text = specTextWithDefinition();
         const hash = yield* sha256Hex(text);
   it.effect("explicit spec refresh accepts a valid OpenAPI document with zero operations", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const emptySpec = JSON.stringify({
           openapi: "3.1.0",
           info: { title: "Empty", version: "1.0.0" },
   it.effect("remove + re-add of the same spec is idempotent over the shared blob", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const text = specText();
         yield* executor.openapi.addSpec({ spec: { kind: "blob", value: text }, slug: "re_add" });

packages/plugins/openapi/src/sdk/spec-overrides-lifecycle.test.ts+10−3

 import { openApiPlugin } from "./plugin";
 import { applySpecOverrides, type SpecOverrides } from "./spec-overrides";
 import { serveMutableOpenApiSpecTestServer } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const testPlugins = () =>
   [openApiPlugin({ httpClientLayer: FetchHttpClient.layer }), memoryCredentialsPlugin()] as const;
   it.effect("applies scope overrides to preview and persists raw and patched hashes", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const sourceText = encodeJsonText(oauthSpec);
         const preview = yield* executor.openapi.previewSpec({
   it.effect("changes and clears overrides for an inline spec without repasting the source", () =>
     Effect.scoped(
       Effect.gen(function* () {
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const sourceText = encodeJsonText(oauthSpec);
         yield* executor.openapi.addSpec({
           spec: { kind: "blob", value: sourceText },
           .add(HttpApiEndpoint.post("create", "/items", { success: Schema.String }));
         const InitialApi = HttpApi.make("initial").add(Items);
         const server = yield* serveMutableOpenApiSpecTestServer({ initialApi: InitialApi });
-        const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+        const executor = yield* createExecutor(
+          makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+        );
         const removeList: SpecOverrides = [{ op: "remove", path: "/paths/~1items/get" }];
         yield* executor.openapi.addSpec({

packages/plugins/openapi/src/sdk/streaming-response.test.ts+7−2

 import { collectStreamingBody, STREAM_MAX_BYTES } from "./invoke";
 import { openApiPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 const testPlugins = () =>
   [openApiPlugin({ httpClientLayer: FetchHttpClient.layer }), memoryCredentialsPlugin()] as const;
 const buildExecutor = (baseUrl: string) =>
   Effect.gen(function* () {
-    const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+    const executor = yield* createExecutor(
+      makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+    );
     yield* executor.openapi.addSpec(
       makeOpenApiHttpApiTestIntegrationConfig(StreamingApi, { slug: "streaming", baseUrl }),
     );
         );
       });
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       yield* executor.openapi.addSpec({
         spec: {
           kind: "blob",

packages/plugins/openapi/src/sdk/tool-row-projection.test.ts+4−1

 import { openApiPlugin } from "./plugin";
 import { serveOpenApiHttpApiTestServer, unwrapInvocation } from "../testing";
+import { testAccess } from "@executor-js/product-access/testing";
 const testPlugins = (httpClientLayer = FetchHttpClient.layer) =>
   [openApiPlugin({ httpClientLayer }), memoryCredentialsPlugin()] as const;
     api: TestApi,
     handlersLayer: EchoGroupLive,
   });
-  const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+  const executor = yield* createExecutor(
+    makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+  );
   yield* executor.openapi.addSpec({
     spec: { kind: "blob", value: server.specJson },
     slug: "proj_api",

packages/plugins/openapi/src/sdk/upstream-failures.test.ts+8−3

 } from "../testing";
 import { openApiPlugin } from "./plugin";
+import { testAccess } from "@executor-js/product-access/testing";
 class AdapterDefect extends Data.TaggedError("AdapterDefect") {}
 const buildExecutor = (baseUrl: string, httpClientLayer = FetchHttpClient.layer) =>
   Effect.gen(function* () {
     const executor = yield* createExecutor(
-      makeTestConfig({ plugins: testPlugins(httpClientLayer) }),
+      makeTestConfig({ access: testAccess.member(), plugins: testPlugins(httpClientLayer) }),
     );
     yield* executor.openapi.addSpec(
       makeOpenApiHttpApiTestIntegrationConfig(FailureApi, { slug: "f", baseUrl }),
 const buildExecutorForOpenApiServer = (server: OpenApiTestServerShape) =>
   Effect.gen(function* () {
-    const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+    const executor = yield* createExecutor(
+      makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+    );
     const conn = yield* addOpenApiTestConnection(executor, server, { slug: "f" });
     return { executor, address: conn.address(LIST_THINGS) };
   });
         headers: { "content-type": "application/json" },
         body: '{"error":{"status":"PERMISSION_DENIED","details":[{"reason":"ACCESS_TOKEN_SCOPE_INSUFFICIENT"}]}}',
       }));
-      const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
+      const executor = yield* createExecutor(
+        makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
+      );
       // Declare the operation's scope in the spec blob before registering it,
       // so the extracted binding carries requiredScopes.
       const SpecJson = Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown));