Move product access rules out of the SDK

Rhys Sullivan committed 1 month ago

Commit c676e561 parent a72e51d161 files · +3935 −867Browse files

Showing the changes to packages/plugins/openapi/src (15 of 161 files). Show all

Unified · Split

15 files

packages/plugins/openapi/src/providers/google/spec-format-adapter.test.ts +4 −0
packages/plugins/openapi/src/sdk/configure.test.ts +25 −8
packages/plugins/openapi/src/sdk/form-urlencoded-body.test.ts +22 −23
packages/plugins/openapi/src/sdk/health-check-redaction.test.ts +2 −0
packages/plugins/openapi/src/sdk/multi-scope-bearer.test.ts +4 −1
packages/plugins/openapi/src/sdk/non-json-body.test.ts +106 −35
packages/plugins/openapi/src/sdk/plugin.test.ts +104 −35
packages/plugins/openapi/src/sdk/real-specs.test.ts +2 −0
packages/plugins/openapi/src/sdk/response-body-timeout.test.ts +4 −1
packages/plugins/openapi/src/sdk/response-headers-timeout.test.ts +4 −1
packages/plugins/openapi/src/sdk/spec-blob.test.ts +15 −6
packages/plugins/openapi/src/sdk/spec-overrides-lifecycle.test.ts +10 −3
packages/plugins/openapi/src/sdk/streaming-response.test.ts +7 −2
packages/plugins/openapi/src/sdk/tool-row-projection.test.ts +4 −1
packages/plugins/openapi/src/sdk/upstream-failures.test.ts +8 −3

packages/plugins/openapi/src/providers/google/spec-format-adapter.test.ts+4−0

@@ -9,6 +9,7 @@ import type { AuthenticationInput } from "@executor-js/plugin-openapi"; · 8 unmodified lines
9	9
10	10	import { deriveGoogleDiscoveryIdentity, googleDiscoveryAdapter } from "./spec-format-adapter";
11	11	import { googleCatalog } from "./presets";
	12	+import { testAccess } from "@executor-js/product-access/testing";
12	13
13	14	const TASKS_URL = "https://www.googleapis.com/discovery/v1/apis/tasks/v1/rest";
14	15	const GMAIL_URL = "https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest";
@@ -179,6 +180,7 @@ it.effect("adds a Google Discovery URL through the OpenAPI plugin with derived i · 164 unmodified lines
179	180	Effect.gen(function* () {
180	181	const executor = yield* createExecutor(
181	182	makeTestConfig({
	183	+ access: testAccess.member(),
182	184	plugins: [
183	185	openApiPlugin({
184	186	httpClientLayer: discoveryHttpClientLayer,
@@ -211,6 +213,7 @@ it.effect( · 26 unmodified lines
211	213	);
212	214	const executor = yield* createExecutor(
213	215	makeTestConfig({
	216	+ access: testAccess.member(),
214	217	plugins: [
215	218	openApiPlugin({
216	219	httpClientLayer: discoveryHttpClientLayer,
@@ -257,6 +260,7 @@ it.effect("preserves a Google preset's full consumer consent boundary when refre · 40 unmodified lines
257	260	);
258	261	const executor = yield* createExecutor(
259	262	makeTestConfig({
	263	+ access: testAccess.member(),
260	264	plugins: [
261	265	openApiPlugin({
262	266	httpClientLayer: gmailDiscoveryHttpClientLayer,

packages/plugins/openapi/src/sdk/configure.test.ts+25−8

@@ -35,6 +35,7 @@ import { · 34 unmodified lines
35	35	serveOpenApiHttpApiTestServer,
36	36	unwrapInvocation,
37	37	} from "../testing";
	38	+import { testAccess } from "@executor-js/product-access/testing";
38	39
39	40	const testPlugins = (httpClientLayer = FetchHttpClient.layer) =>
40	41	[openApiPlugin({ httpClientLayer }), memoryCredentialsPlugin()] as const;
@@ -90,7 +91,9 @@ describe("OpenAPI Plugin — configure (custom auth method)", () => { · 49 unmodified lines
90	91	it.effect("adds a custom apiKey method and getConfig reflects it", () =>
91	92	Effect.scoped(
92	93	Effect.gen(function* () {
93		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	94	+ const executor = yield* createExecutor(
	95	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	96	+ );
94	97
95	98	yield* executor.openapi.addSpec({
96	99	spec: { kind: "blob", value: specText() },
@@ -119,7 +122,9 @@ describe("OpenAPI Plugin — configure (custom auth method)", () => { · 22 unmodified lines
119	122	it.effect("appends to an existing spec-derived template without dropping entries", () =>
120	123	Effect.scoped(
121	124	Effect.gen(function* () {
122		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	125	+ const executor = yield* createExecutor(
	126	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	127	+ );
123	128
124	129	const seedTemplate: AuthenticationInput = {
125	130	slug: "seed",
@@ -145,7 +150,9 @@ describe("OpenAPI Plugin — configure (custom auth method)", () => { · 19 unmodified lines
145	150	it.effect("generates a custom_<id> slug for a method submitted without one", () =>
146	151	Effect.scoped(
147	152	Effect.gen(function* () {
148		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	153	+ const executor = yield* createExecutor(
	154	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	155	+ );
149	156
150	157	yield* executor.openapi.addSpec({
151	158	spec: { kind: "blob", value: specText() },
@@ -167,7 +174,9 @@ describe("OpenAPI Plugin — configure (custom auth method)", () => { · 15 unmodified lines
167	174	it.effect("dedupes: a matching slug replaces in place; two slugless get distinct slugs", () =>
168	175	Effect.scoped(
169	176	Effect.gen(function* () {
170		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	177	+ const executor = yield* createExecutor(
	178	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	179	+ );
171	180
172	181	yield* executor.openapi.addSpec({
173	182	spec: { kind: "blob", value: specText() },
@@ -208,7 +217,9 @@ describe("OpenAPI Plugin — configure (custom auth method)", () => { · 34 unmodified lines
208	217	it.effect("replace mode overwrites the auth template array", () =>
209	218	Effect.scoped(
210	219	Effect.gen(function* () {
211		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	220	+ const executor = yield* createExecutor(
	221	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	222	+ );
212	223
213	224	const seedTemplate: AuthenticationInput = {
214	225	slug: "seed",
@@ -236,7 +247,9 @@ describe("OpenAPI Plugin — configure (custom auth method)", () => { · 21 unmodified lines
236	247	Effect.scoped(
237	248	Effect.gen(function* () {
238	249	const server = yield* servePluginTestApi();
239		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	250	+ const executor = yield* createExecutor(
	251	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	252	+ );
240	253
241	254	yield* executor.openapi.addSpec({
242	255	spec: { kind: "blob", value: server.specJson },
@@ -272,7 +285,9 @@ describe("OpenAPI Plugin — configure (custom auth method)", () => { · 29 unmodified lines
272	285	Effect.scoped(
273	286	Effect.gen(function* () {
274	287	const server = yield* servePluginTestApi();
275		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	288	+ const executor = yield* createExecutor(
	289	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	290	+ );
276	291
277	292	yield* executor.openapi.addSpec({
278	293	spec: { kind: "blob", value: server.specJson },
@@ -320,7 +335,9 @@ describe("OpenAPI Plugin — configure (custom auth method)", () => { · 41 unmodified lines
320	335	it.effect("getConfig returns null for an unknown integration", () =>
321	336	Effect.scoped(
322	337	Effect.gen(function* () {
323		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	338	+ const executor = yield* createExecutor(
	339	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	340	+ );
324	341	expect(yield* executor.openapi.getConfig("nope")).toBeNull();
325	342	}),
326	343	),

packages/plugins/openapi/src/sdk/form-urlencoded-body.test.ts+22−23

@@ -30,6 +30,7 @@ import { · 29 unmodified lines
30	30	} from "@executor-js/plugin-openapi/testing";
31	31
32	32	import { openApiPlugin } from "./plugin";
	33	+import { testAccess } from "@executor-js/product-access/testing";
33	34
34	35	type Captured = {
35	36	contentType: string;
@@ -76,30 +77,28 @@ const plugins = [ · 40 unmodified lines
76	77	memoryCredentialsPlugin(),
77	78	] as const;
78	79
79		−layer(
80		− makeTestWorkspaceLayer({
81		− plugins,
82		− }),
83		− { timeout: "15 seconds" },
84		−)("OpenAPI non-JSON request body serialization", (it) => {
85		− it.effect("form-urlencoded object body is properly encoded (no '[object Object]')", () =>
86		− Effect.gen(function* () {
87		− const { server, captured } = yield* startEchoServer();
88		− const { config } = yield* TestWorkspace;
89		− const executor = yield* createExecutor({ ...config, plugins });
	80	+layer(makeTestWorkspaceLayer({ access: testAccess.member(), plugins }), { timeout: "15 seconds" })(
	81	+ "OpenAPI non-JSON request body serialization",
	82	+ (it) => {
	83	+ it.effect("form-urlencoded object body is properly encoded (no '[object Object]')", () =>
	84	+ Effect.gen(function* () {
	85	+ const { server, captured } = yield* startEchoServer();
	86	+ const { config } = yield* TestWorkspace;
	87	+ const executor = yield* createExecutor({ ...config, plugins });
90	88
91		− const conn = yield* addOpenApiTestConnection(executor, server, { slug: "form" });
	89	+ const conn = yield* addOpenApiTestConnection(executor, server, { slug: "form" });
92	90
93		− yield* executor.execute(conn.address("forms.submit"), {
94		− body: { name: "Acme", email: "a@b.com" },
95		− });
	91	+ yield* executor.execute(conn.address("forms.submit"), {
	92	+ body: { name: "Acme", email: "a@b.com" },
	93	+ });
96	94
97		− expect(captured.contentType).toBe("application/x-www-form-urlencoded");
98		− expect(captured.body).not.toBe("[object Object]");
	95	+ expect(captured.contentType).toBe("application/x-www-form-urlencoded");
	96	+ expect(captured.body).not.toBe("[object Object]");
99	97
100		− const parsed = new URLSearchParams(captured.body);
101		− expect(parsed.get("name")).toBe("Acme");
102		− expect(parsed.get("email")).toBe("a@b.com");
103		− }),
104		− );
105		−});
	98	+ const parsed = new URLSearchParams(captured.body);
	99	+ expect(parsed.get("name")).toBe("Acme");
	100	+ expect(parsed.get("email")).toBe("a@b.com");
	101	+ }),
	102	+ );
	103	+ },
	104	+);

packages/plugins/openapi/src/sdk/health-check-redaction.test.ts+2−0

@@ -34,6 +34,7 @@ import { variable } from "@executor-js/sdk/http-auth"; · 33 unmodified lines
34	34
35	35	import { serveOpenApiHttpApiTestServer } from "../testing";
36	36	import { openApiPlugin } from "./plugin";
	37	+import { testAccess } from "@executor-js/product-access/testing";
37	38
38	39	/** The credential the connection authenticates with. Longer than the sample's
39	40	* 120-char value cap on purpose: truncating before scrubbing would leave a
@@ -84,6 +85,7 @@ const withProbe = <A, E, R>( · 44 unmodified lines
84	85	});
85	86	const executor = yield* createExecutor(
86	87	makeTestConfig({
	88	+ access: testAccess.member(),
87	89	plugins: [
88	90	openApiPlugin({ httpClientLayer: FetchHttpClient.layer }),
89	91	memoryCredentialsPlugin(),

packages/plugins/openapi/src/sdk/multi-scope-bearer.test.ts+4−1

@@ -37,6 +37,7 @@ import { · 36 unmodified lines
37	37
38	38	import { openApiPlugin } from "./plugin";
39	39	import { type AuthenticationInput } from "./types";
	40	+import { testAccess } from "@executor-js/product-access/testing";
40	41
41	42	// ---------------------------------------------------------------------------
42	43	// Test API — a single endpoint that echoes the Authorization header so the
@@ -86,7 +87,9 @@ describe("OpenAPI owner-isolated bearer", () => { · 43 unmodified lines
86	87	Effect.scoped(
87	88	Effect.gen(function* () {
88	89	const server = yield* serveVercel();
89		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	90	+ const executor = yield* createExecutor(
	91	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	92	+ );
90	93
91	94	// Admin uploads the spec once; the integration declares a bearer
92	95	// template but no token value.

packages/plugins/openapi/src/sdk/non-json-body.test.ts+106−35

@@ -32,6 +32,7 @@ import { · 31 unmodified lines
32	32	} from "@executor-js/plugin-openapi/testing";
33	33
34	34	import { openApiPlugin } from "./plugin";
	35	+import { testAccess } from "@executor-js/product-access/testing";
35	36
36	37	const JsonNameBody = Schema.fromJsonString(
37	38	Schema.Struct({
@@ -172,7 +173,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 134 unmodified lines
172	173	payload: ObjectBody.pipe(HttpApiSchema.asMultipart()),
173	174	});
174	175
175		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	176	+ const executor = yield* createExecutor(
	177	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	178	+ );
176	179
177	180	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mp" });
178	181
@@ -222,7 +225,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 43 unmodified lines
222	225	),
223	226	});
224	227
225		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	228	+ const executor = yield* createExecutor(
	229	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	230	+ );
226	231	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "paperless" });
227	232
228	233	const schema = yield* executor.tools.schema(conn.address("body.upload"));
@@ -298,7 +303,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 69 unmodified lines
298	303	),
299	304	});
300	305
301		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	306	+ const executor = yield* createExecutor(
	307	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	308	+ );
302	309	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "pages" });
303	310
304	311	const schema = yield* executor.tools.schema(conn.address("body.uploadPages"));
@@ -378,7 +385,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 73 unmodified lines
378	385	}),
379	386	});
380	387
381		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	388	+ const executor = yield* createExecutor(
	389	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	390	+ );
382	391	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "broken" });
383	392
384	393	const exit = yield* executor
@@ -424,7 +433,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 39 unmodified lines
424	433	}),
425	434	});
426	435
427		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	436	+ const executor = yield* createExecutor(
	437	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	438	+ );
428	439	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "notes" });
429	440
430	441	// The rewrite is scoped to multipart bodies: a JSON body keeps its
@@ -465,7 +476,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 34 unmodified lines
465	476	}),
466	477	});
467	478
468		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	479	+ const executor = yield* createExecutor(
	480	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	481	+ );
469	482	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "notes-jsonapi" });
470	483
471	484	yield* executor.execute(conn.address("body.createNote"), {
@@ -511,7 +524,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 39 unmodified lines
511	524	}),
512	525	});
513	526
514		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	527	+ const executor = yield* createExecutor(
	528	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	529	+ );
515	530	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mixed" });
516	531
517	532	const schema = yield* executor.tools.schema(conn.address("body.uploadMixed"));
@@ -564,7 +579,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 46 unmodified lines
564	579	},
565	580	});
566	581
567		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	582	+ const executor = yield* createExecutor(
	583	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	584	+ );
568	585	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "reffed" });
569	586
570	587	// Documented limitation: component schemas are carried through
@@ -584,7 +601,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 13 unmodified lines
584	601	payload: Schema.String.pipe(HttpApiSchema.asText({ contentType: "application/xml" })),
585	602	});
586	603
587		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	604	+ const executor = yield* createExecutor(
	605	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	606	+ );
588	607
589	608	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "xml" });
590	609
@@ -603,7 +622,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 12 unmodified lines
603	622	transformSpec: replaceRequestBodyContent("/submit", "post", contentFor("text/xml")),
604	623	});
605	624
606		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	625	+ const executor = yield* createExecutor(
	626	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	627	+ );
607	628
608	629	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "tx" });
609	630
@@ -622,7 +643,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 12 unmodified lines
622	643	payload: Schema.String.pipe(HttpApiSchema.asText()),
623	644	});
624	645
625		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	646	+ const executor = yield* createExecutor(
	647	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	648	+ );
626	649
627	650	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "tp" });
628	651
@@ -639,7 +662,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 10 unmodified lines
639	662	payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
640	663	});
641	664
642		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	665	+ const executor = yield* createExecutor(
	666	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	667	+ );
643	668
644	669	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin" });
645	670
@@ -658,7 +683,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 12 unmodified lines
658	683	payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
659	684	});
660	685
661		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	686	+ const executor = yield* createExecutor(
	687	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	688	+ );
662	689
663	690	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin_b64" });
664	691
@@ -677,7 +704,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 12 unmodified lines
677	704	payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
678	705	});
679	706
680		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	707	+ const executor = yield* createExecutor(
	708	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	709	+ );
681	710
682	711	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin_b64_bad" });
683	712
@@ -699,7 +728,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 15 unmodified lines
699	728	payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
700	729	});
701	730
702		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	731	+ const executor = yield* createExecutor(
	732	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	733	+ );
703	734
704	735	const conn = yield* addOpenApiTestConnection(executor, server, {
705	736	slug: "bin_nested_b64_bad",
@@ -723,7 +754,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 17 unmodified lines
723	754	payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
724	755	});
725	756
726		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	757	+ const executor = yield* createExecutor(
	758	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	759	+ );
727	760
728	761	const conn = yield* addOpenApiTestConnection(executor, server, {
729	762	slug: "bin_b64_missing",
@@ -743,7 +776,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 13 unmodified lines
743	776	payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
744	777	});
745	778
746		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	779	+ const executor = yield* createExecutor(
	780	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	781	+ );
747	782
748	783	const conn = yield* addOpenApiTestConnection(executor, server, {
749	784	slug: "bin_object_body",
@@ -767,7 +802,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 17 unmodified lines
767	802	payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
768	803	});
769	804
770		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	805	+ const executor = yield* createExecutor(
	806	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	807	+ );
771	808
772	809	const conn = yield* addOpenApiTestConnection(executor, server, {
773	810	slug: "bin_string_body",
@@ -837,7 +874,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 63 unmodified lines
837	874	}),
838	875	});
839	876
840		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	877	+ const executor = yield* createExecutor(
	878	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	879	+ );
841	880	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "gmail" });
842	881
843	882	const schema = yield* executor.tools.schema(conn.address("gmail.getAttachment"));
@@ -921,7 +960,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 77 unmodified lines
921	960	}),
922	961	});
923	962
924		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	963	+ const executor = yield* createExecutor(
	964	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	965	+ );
925	966	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "gmail_text" });
926	967
927	968	const result = yield* executor.execute(conn.address("gmailText.getAttachment"), {
@@ -989,7 +1030,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 61 unmodified lines
989	1030	}),
990	1031	});
991	1032
992		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1033	+ const executor = yield* createExecutor(
	1034	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1035	+ );
993	1036	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "zip_attachment" });
994	1037
995	1038	const result = yield* executor.execute(conn.address("zipAttachment.getAttachment"), {
@@ -1107,7 +1150,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 111 unmodified lines
1107	1150	),
1108	1151	});
1109	1152
1110		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1153	+ const executor = yield* createExecutor(
	1154	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1155	+ );
1111	1156	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "gmail_meta" });
1112	1157
1113	1158	const result = yield* executor.execute(conn.address("gmailMeta.getAttachment"), {
@@ -1156,7 +1201,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 42 unmodified lines
1156	1201	}),
1157	1202	});
1158	1203
1159		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1204	+ const executor = yield* createExecutor(
	1205	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1206	+ );
1160	1207	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "files" });
1161	1208
1162	1209	const schema = yield* executor.tools.schema(conn.address("files.download"));
@@ -1210,7 +1257,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 47 unmodified lines
1210	1257	}),
1211	1258	});
1212	1259
1213		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1260	+ const executor = yield* createExecutor(
	1261	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1262	+ );
1214	1263	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "files" });
1215	1264
1216	1265	const result = yield* executor.execute(conn.address("files.download"), {
@@ -1247,7 +1296,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 30 unmodified lines
1247	1296	payload: multiContentPayload,
1248	1297	});
1249	1298
1250		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1299	+ const executor = yield* createExecutor(
	1300	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1301	+ );
1251	1302
1252	1303	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc" });
1253	1304
@@ -1265,7 +1316,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 11 unmodified lines
1265	1316	payload: multiContentPayload,
1266	1317	});
1267	1318
1268		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1319	+ const executor = yield* createExecutor(
	1320	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1321	+ );
1269	1322
1270	1323	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc2" });
1271	1324
@@ -1295,7 +1348,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 23 unmodified lines
1295	1348	}),
1296	1349	});
1297	1350
1298		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1351	+ const executor = yield* createExecutor(
	1352	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1353	+ );
1299	1354
1300	1355	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc_b64" });
1301	1356
@@ -1322,7 +1377,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 20 unmodified lines
1322	1377	}),
1323	1378	});
1324	1379
1325		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1380	+ const executor = yield* createExecutor(
	1381	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1382	+ );
1326	1383
1327	1384	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc_b64_bad_ct" });
1328	1385
@@ -1352,7 +1409,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 23 unmodified lines
1352	1409	},
1353	1410	}),
1354	1411	});
1355		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1412	+ const executor = yield* createExecutor(
	1413	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1414	+ );
1356	1415
1357	1416	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mc_b64_schema" });
1358	1417
@@ -1375,7 +1434,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 16 unmodified lines
1375	1434	const { server } = yield* startEchoServer({
1376	1435	payload: multiContentPayload,
1377	1436	});
1378		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1437	+ const executor = yield* createExecutor(
	1438	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1439	+ );
1379	1440
1380	1441	const conn = yield* addOpenApiTestConnection(executor, server, {
1381	1442	slug: "mc3",
@@ -1404,7 +1465,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 22 unmodified lines
1404	1465	const { server } = yield* startEchoServer({
1405	1466	payload: Schema.Uint8Array.pipe(HttpApiSchema.asUint8Array()),
1406	1467	});
1407		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1468	+ const executor = yield* createExecutor(
	1469	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1470	+ );
1408	1471
1409	1472	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "bin_schema" });
1410	1473
@@ -1450,7 +1513,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 39 unmodified lines
1450	1513	),
1451	1514	});
1452	1515
1453		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1516	+ const executor = yield* createExecutor(
	1517	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1518	+ );
1454	1519
1455	1520	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "mpe" });
1456	1521
@@ -1492,7 +1557,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 35 unmodified lines
1492	1557	),
1493	1558	});
1494	1559
1495		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1560	+ const executor = yield* createExecutor(
	1561	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1562	+ );
1496	1563
1497	1564	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "fe" });
1498	1565
@@ -1523,7 +1590,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 24 unmodified lines
1523	1590	),
1524	1591	});
1525	1592
1526		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1593	+ const executor = yield* createExecutor(
	1594	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1595	+ );
1527	1596
1528	1597	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "fd" });
1529	1598
@@ -1550,7 +1619,9 @@ describe("OpenAPI non-JSON request body dispatch", () => { · 20 unmodified lines
1550	1619	),
1551	1620	});
1552	1621
1553		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1622	+ const executor = yield* createExecutor(
	1623	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1624	+ );
1554	1625
1555	1626	// No encoding → OAS3 defaults: style=form, explode=true.
1556	1627	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "fdx" });

packages/plugins/openapi/src/sdk/plugin.test.ts+104−35

@@ -49,6 +49,7 @@ import { · 48 unmodified lines
49	49	serveOpenApiHttpApiTestServer,
50	50	unwrapInvocation,
51	51	} from "../testing";
	52	+import { testAccess } from "@executor-js/product-access/testing";
52	53
53	54	const TOOL_ERROR_TYPESCRIPT =
54	55	"{ code: string; message: string; status?: number; details?: unknown; retryable?: boolean }";
@@ -393,7 +394,9 @@ describe("OpenAPI Plugin", () => { · 338 unmodified lines
393	394	Effect.gen(function* () {
394	395	const server = yield* servePluginTestApi();
395	396
396		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	397	+ const executor = yield* createExecutor(
	398	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	399	+ );
397	400
398	401	const preview = yield* executor.openapi.previewSpec(server.specJson);
399	402
@@ -408,7 +411,10 @@ describe("OpenAPI Plugin", () => { · 8 unmodified lines
408	411	Effect.gen(function* () {
409	412	const server = yield* serveOAuthDiscoverableOpenApiSpec();
410	413	const executor = yield* createExecutor(
411		− makeTestConfig({ plugins: testPlugins(server.httpClientLayer) }),
	414	+ makeTestConfig({
	415	+ access: testAccess.member(),
	416	+ plugins: testPlugins(server.httpClientLayer),
	417	+ }),
412	418	);
413	419
414	420	const preview = yield* executor.openapi.previewSpec(server.url("/api/schema/"));
@@ -456,7 +462,9 @@ describe("OpenAPI Plugin", () => { · 41 unmodified lines
456	462
457	463	it.effect("exposes static openapi executor control tools via execute", () =>
458	464	Effect.gen(function* () {
459		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	465	+ const executor = yield* createExecutor(
	466	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	467	+ );
460	468
461	469	// v2: static control tools are NOT part of `tools.list()` (that's the
462	470	// persisted per-connection catalog) and aren't `tools.schema()`-resolvable;
@@ -473,7 +481,9 @@ describe("OpenAPI Plugin", () => { · 10 unmodified lines
473	481
474	482	it.effect("invokes static previewSpec through executor.execute", () =>
475	483	Effect.gen(function* () {
476		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	484	+ const executor = yield* createExecutor(
	485	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	486	+ );
477	487
478	488	const preview = unwrapInvocation(
479	489	yield* executor.execute(ToolAddress.make("executor.openapi.previewSpec"), {
@@ -495,7 +505,9 @@ describe("OpenAPI Plugin", () => { · 15 unmodified lines
495	505
496	506	it.effect("invokes static addSpec through executor.execute", () =>
497	507	Effect.gen(function* () {
498		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	508	+ const executor = yield* createExecutor(
	509	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	510	+ );
499	511
500	512	const result = unwrapInvocation(
501	513	yield* executor.execute(ToolAddress.make("executor.openapi.addSpec"), {
@@ -517,7 +529,9 @@ describe("OpenAPI Plugin", () => { · 15 unmodified lines
517	529	Effect.scoped(
518	530	Effect.gen(function* () {
519	531	const specServer = yield* serveMutableOpenApiSpecTestServer({ initialApi: TestApi });
520		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	532	+ const executor = yield* createExecutor(
	533	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	534	+ );
521	535
522	536	yield* executor.openapi.addSpec({
523	537	spec: { kind: "url", url: specServer.specUrl },
@@ -565,7 +579,10 @@ describe("OpenAPI Plugin", () => { · 41 unmodified lines
565	579
566	580	it.effect("static previewSpec returns actionable tool failures", () =>
567	581	Effect.gen(function* () {
568		− const config = makeTestConfig({ plugins: [openApiPlugin()] as const });
	582	+ const config = makeTestConfig({
	583	+ access: testAccess.member(),
	584	+ plugins: [openApiPlugin()] as const,
	585	+ });
569	586	const executor = yield* createExecutor(config);
570	587
571	588	const result = yield* executor.execute(ToolAddress.make("executor.openapi.previewSpec"), {
@@ -587,7 +604,7 @@ describe("OpenAPI Plugin", () => { · 15 unmodified lines
587	604	it.effect("requires approval before adding an integration through the runtime tool", () =>
588	605	Effect.gen(function* () {
589	606	const executor = yield* createExecutor(
590		− makeTestConfig({ plugins: [openApiPlugin()] as const }),
	607	+ makeTestConfig({ access: testAccess.member(), plugins: [openApiPlugin()] as const }),
591	608	);
592	609
593	610	const declined = yield* executor
@@ -607,7 +624,9 @@ describe("OpenAPI Plugin", () => { · 13 unmodified lines
607	624	Effect.scoped(
608	625	Effect.gen(function* () {
609	626	const server = yield* servePluginTestApi();
610		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	627	+ const executor = yield* createExecutor(
	628	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	629	+ );
611	630
612	631	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
613	632
@@ -625,7 +644,9 @@ describe("OpenAPI Plugin", () => { · 11 unmodified lines
625	644	Effect.scoped(
626	645	Effect.gen(function* () {
627	646	const server = yield* servePluginTestApi();
628		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	647	+ const executor = yield* createExecutor(
	648	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	649	+ );
629	650
630	651	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
631	652
@@ -642,7 +663,9 @@ describe("OpenAPI Plugin", () => { · 10 unmodified lines
642	663	Effect.scoped(
643	664	Effect.gen(function* () {
644	665	const server = yield* servePluginTestApi();
645		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	666	+ const executor = yield* createExecutor(
	667	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	668	+ );
646	669
647	670	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
648	671	const calls = { count: 0 };
@@ -671,7 +694,9 @@ describe("OpenAPI Plugin", () => { · 22 unmodified lines
671	694	Effect.scoped(
672	695	Effect.gen(function* () {
673	696	const server = yield* servePluginTestApi();
674		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	697	+ const executor = yield* createExecutor(
	698	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	699	+ );
675	700
676	701	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
677	702	const calls = { count: 0 };
@@ -705,7 +730,9 @@ describe("OpenAPI Plugin", () => { · 27 unmodified lines
705	730	Effect.scoped(
706	731	Effect.gen(function* () {
707	732	const server = yield* servePluginTestApi();
708		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	733	+ const executor = yield* createExecutor(
	734	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	735	+ );
709	736
710	737	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
711	738	const calls = { count: 0 };
@@ -738,7 +765,9 @@ describe("OpenAPI Plugin", () => { · 26 unmodified lines
738	765	Effect.scoped(
739	766	Effect.gen(function* () {
740	767	const server = yield* servePluginTestApi();
741		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	768	+ const executor = yield* createExecutor(
	769	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	770	+ );
742	771
743	772	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
744	773	const calls = { count: 0 };
@@ -771,7 +800,9 @@ describe("OpenAPI Plugin", () => { · 26 unmodified lines
771	800	Effect.scoped(
772	801	Effect.gen(function* () {
773	802	const server = yield* servePluginTestApi();
774		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	803	+ const executor = yield* createExecutor(
	804	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	805	+ );
775	806
776	807	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
777	808
@@ -812,7 +843,9 @@ describe("OpenAPI Plugin", () => { · 34 unmodified lines
812	843	Effect.scoped(
813	844	Effect.gen(function* () {
814	845	const server = yield* servePluginTestApi();
815		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	846	+ const executor = yield* createExecutor(
	847	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	848	+ );
816	849
817	850	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
818	851
@@ -829,7 +862,9 @@ describe("OpenAPI Plugin", () => { · 10 unmodified lines
829	862	Effect.scoped(
830	863	Effect.gen(function* () {
831	864	const server = yield* servePluginTestApi();
832		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	865	+ const executor = yield* createExecutor(
	866	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	867	+ );
833	868
834	869	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "test" });
835	870	const failure = yield* executor
@@ -853,7 +888,9 @@ describe("OpenAPI Plugin", () => { · 17 unmodified lines
853	888	Effect.scoped(
854	889	Effect.gen(function* () {
855	890	const server = yield* servePluginTestApi();
856		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	891	+ const executor = yield* createExecutor(
	892	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	893	+ );
857	894	const multiServer = {
858	895	...server,
859	896	specJson: makeOpenApiTestSpecJson(TestApi, {
@@ -889,7 +926,9 @@ describe("OpenAPI Plugin", () => { · 29 unmodified lines
889	926	const server = yield* serveOpenApiEchoTestServer({
890	927	transformSpec: withEchoCookieParameter,
891	928	});
892		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	929	+ const executor = yield* createExecutor(
	930	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	931	+ );
893	932	const conn = yield* addOpenApiTestConnection(executor, server, {
894	933	slug: "cookie_params",
895	934	headers: { Cookie: "configured=yes" },
@@ -923,7 +962,9 @@ describe("OpenAPI Plugin", () => { · 27 unmodified lines
923	962	const server = yield* serveOpenApiEchoTestServer({
924	963	transformSpec: withEchoCookieParameter,
925	964	});
926		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	965	+ const executor = yield* createExecutor(
	966	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	967	+ );
927	968	const conn = yield* addOpenApiTestConnection(executor, server, {
928	969	slug: "cookie_unknown",
929	970	});
@@ -951,7 +992,9 @@ describe("OpenAPI Plugin", () => { · 21 unmodified lines
951	992	Effect.scoped(
952	993	Effect.gen(function* () {
953	994	const server = yield* servePluginTestApi();
954		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	995	+ const executor = yield* createExecutor(
	996	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	997	+ );
955	998
956	999	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "records" });
957	1000
@@ -980,7 +1023,9 @@ describe("OpenAPI Plugin", () => { · 22 unmodified lines
980	1023	Effect.scoped(
981	1024	Effect.gen(function* () {
982	1025	const server = yield* servePluginTestApi();
983		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1026	+ const executor = yield* createExecutor(
	1027	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1028	+ );
984	1029
985	1030	yield* executor.openapi.addSpec({
986	1031	spec: { kind: "blob", value: server.specJson },
@@ -1012,7 +1057,9 @@ describe("OpenAPI Plugin", () => { · 25 unmodified lines
1012	1057	Effect.scoped(
1013	1058	Effect.gen(function* () {
1014	1059	const server = yield* servePluginTestApi();
1015		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1060	+ const executor = yield* createExecutor(
	1061	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1062	+ );
1016	1063
1017	1064	yield* executor.openapi.addSpec({
1018	1065	spec: { kind: "blob", value: server.specJson },
@@ -1044,7 +1091,9 @@ describe("OpenAPI Plugin", () => { · 25 unmodified lines
1044	1091	Effect.scoped(
1045	1092	Effect.gen(function* () {
1046	1093	const server = yield* servePluginTestApi();
1047		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1094	+ const executor = yield* createExecutor(
	1095	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1096	+ );
1048	1097
1049	1098	// The spec declares bearer auth; the caller passes NO template — the
1050	1099	// agentic add path (MCP/API) does exactly this. Without server-side
@@ -1097,7 +1146,9 @@ describe("OpenAPI Plugin", () => { · 46 unmodified lines
1097	1146	Effect.scoped(
1098	1147	Effect.gen(function* () {
1099	1148	const server = yield* servePluginTestApi();
1100		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1149	+ const executor = yield* createExecutor(
	1150	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1151	+ );
1101	1152
1102	1153	// No baseUrl override: the spec declares `servers`, so the host is
1103	1154	// resolved per call from the operation's servers rather than baked into
@@ -1127,7 +1178,9 @@ describe("OpenAPI Plugin", () => { · 23 unmodified lines
1127	1178	Effect.scoped(
1128	1179	Effect.gen(function* () {
1129	1180	const server = yield* servePluginTestApi();
1130		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1181	+ const executor = yield* createExecutor(
	1182	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1183	+ );
1131	1184
1132	1185	// The add page sends [] when the user deletes every detected method.
1133	1186	// That intent must survive — deriving methods back from the spec here
@@ -1158,7 +1211,9 @@ describe("OpenAPI Plugin", () => { · 24 unmodified lines
1158	1211
1159	1212	it.effect("addSpec accepts Graph-sized OpenAPI blobs", () =>
1160	1213	Effect.gen(function* () {
1161		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1214	+ const executor = yield* createExecutor(
	1215	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1216	+ );
1162	1217	const largeDescription = "x".repeat(36 * 1024 * 1024);
1163	1218
1164	1219	const added = yield* executor.openapi.addSpec({
@@ -1191,7 +1246,9 @@ paths: · 26 unmodified lines
1191	1246	"addSpec accepts Microsoft Graph-scale operation catalogs from one spec",
1192	1247	() =>
1193	1248	Effect.gen(function* () {
1194		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1249	+ const executor = yield* createExecutor(
	1250	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1251	+ );
1195	1252
1196	1253	const added = yield* executor.openapi.addSpec({
1197	1254	spec: { kind: "blob", value: microsoftGraphScaleSpecText() },
@@ -1208,7 +1265,9 @@ paths: · 10 unmodified lines
1208	1265	Effect.scoped(
1209	1266	Effect.gen(function* () {
1210	1267	const server = yield* servePluginTestApi();
1211		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1268	+ const executor = yield* createExecutor(
	1269	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1270	+ );
1212	1271
1213	1272	yield* addOpenApiTestConnection(executor, server, { slug: "removable" });
1214	1273	expect((yield* executor.tools.list()).map((t) => String(t.name))).toContain(
@@ -1232,7 +1291,9 @@ paths: · 17 unmodified lines
1232	1291	Effect.scoped(
1233	1292	Effect.gen(function* () {
1234	1293	const server = yield* servePluginTestApi();
1235		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1294	+ const executor = yield* createExecutor(
	1295	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1296	+ );
1236	1297
1237	1298	// First add carries an apiKey auth template + a distinctive description.
1238	1299	// A silent upsert on re-add would clobber both.
@@ -1294,7 +1355,9 @@ paths: · 55 unmodified lines
1294	1355	// The mutable spec server is a real 127.0.0.1 listener — reach it over
1295	1356	// the default fetch-based client, like production would.
1296	1357	const specServer = yield* serveMutableOpenApiSpecTestServer({ initialApi: TestApi });
1297		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1358	+ const executor = yield* createExecutor(
	1359	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1360	+ );
1298	1361
1299	1362	const added = yield* executor.openapi.addSpec({
1300	1363	spec: { kind: "url", url: specServer.specUrl },
@@ -1370,7 +1433,7 @@ paths: · 69 unmodified lines
1370	1433	it.effect("denies member updateSpec before writing an org blob", () =>
1371	1434	Effect.gen(function* () {
1372	1435	const blobs = recordingBlobStore();
1373		− const config = makeTestConfig({ plugins: testPlugins() });
	1436	+ const config = makeTestConfig({ access: testAccess.member(), plugins: testPlugins() });
1374	1437	const admin = yield* createExecutor({ ...config, blobs: blobs.store });
1375	1438	yield* admin.openapi.addSpec({
1376	1439	spec: { kind: "blob", value: testApiSpecText() },
@@ -1380,7 +1443,7 @@ paths: · 3 unmodified lines
1380	1443	const member = yield* createExecutor({
1381	1444	...config,
1382	1445	blobs: blobs.store,
1383		− orgWrites: "denied",
	1446	+ access: testAccess.member("denied"),
1384	1447	});
1385	1448
1386	1449	const error = yield* member.openapi
@@ -1398,7 +1461,9 @@ paths: · 11 unmodified lines
1398	1461	Effect.scoped(
1399	1462	Effect.gen(function* () {
1400	1463	const server = yield* servePluginTestApi();
1401		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1464	+ const executor = yield* createExecutor(
	1465	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1466	+ );
1402	1467	yield* addOpenApiTestConnection(executor, server, { slug: "pasted" });
1403	1468
1404	1469	// A pasted-blob integration has no source URL — re-fetch must say so.
@@ -1450,6 +1515,7 @@ paths: · 45 unmodified lines
1450	1515	const plugins = testPlugins();
1451	1516
1452	1517	const alice = yield* makeTestWorkspaceHarness({
	1518	+ access: testAccess.member(),
1453	1519	plugins,
1454	1520	tenant,
1455	1521	subject: "alice",
@@ -1470,6 +1536,7 @@ paths: · 14 unmodified lines
1470	1536	});
1471	1537
1472	1538	const bob = yield* makeTestWorkspaceHarness({
	1539	+ access: testAccess.member(),
1473	1540	plugins,
1474	1541	tenant,
1475	1542	subject: "bob",
@@ -1513,7 +1580,9 @@ paths: · 37 unmodified lines
1513	1580
1514	1581	it.effect("updateSpec on an unknown slug fails with IntegrationNotFoundError", () =>
1515	1582	Effect.gen(function* () {
1516		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	1583	+ const executor = yield* createExecutor(
	1584	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	1585	+ );
1517	1586	const error = yield* executor.openapi.updateSpec("missing").pipe(Effect.flip);
1518	1587	expect(Predicate.isTagged(error, "IntegrationNotFoundError")).toBe(true);
1519	1588	}),

packages/plugins/openapi/src/sdk/real-specs.test.ts+2−0

@@ -28,6 +28,7 @@ import { openApiPlugin } from "./plugin"; · 27 unmodified lines
28	28	import { deriveAuthenticationTemplateFromPreview } from "./derive-auth";
29	29	import { previewSpec as previewSpecRaw } from "./preview";
30	30	import type { ExtractionResult } from "./types";
	31	+import { testAccess } from "@executor-js/product-access/testing";
31	32
32	33	const previewSpec = (input: string) =>
33	34	previewSpecRaw(input).pipe(Effect.provide(FetchHttpClient.layer));
@@ -91,6 +92,7 @@ const getRegisteredToolSchema = (slug: string, specText: string, toolName: strin · 57 unmodified lines
91	92
92	93	const executor = yield* createExecutor(
93	94	makeTestConfig({
	95	+ access: testAccess.member(),
94	96	plugins: [openApiPlugin(), memoryCredentialsPlugin()] as const,
95	97	}),
96	98	);

packages/plugins/openapi/src/sdk/response-body-timeout.test.ts+4−1

@@ -16,6 +16,7 @@ import { makeTestConfig, memoryCredentialsPlugin } from "@executor-js/sdk/testin · 15 unmodified lines
16	16	import { makeOpenApiHttpApiTestIntegrationConfig } from "../testing";
17	17
18	18	import { openApiPlugin } from "./plugin";
	19	+import { testAccess } from "@executor-js/product-access/testing";
19	20
20	21	const BODY_READ_DEADLINE_MS = 15_000;
21	22	const RESPONSE_BODY_TIMEOUT_MS = 100;
@@ -42,7 +43,9 @@ const testPlugins = () => · 20 unmodified lines
42	43
43	44	const buildExecutor = (baseUrl: string) =>
44	45	Effect.gen(function* () {
45		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	46	+ const executor = yield* createExecutor(
	47	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	48	+ );
46	49	yield* executor.openapi.addSpec(
47	50	makeOpenApiHttpApiTestIntegrationConfig(TimeoutApi, {
48	51	slug: "body_timeout",

packages/plugins/openapi/src/sdk/response-headers-timeout.test.ts+4−1

@@ -18,6 +18,7 @@ import { makeOpenApiHttpApiTestIntegrationConfig, unwrapInvocation } from "../te · 17 unmodified lines
18	18	import { invokeWithLayer } from "./invoke";
19	19	import { openApiPlugin } from "./plugin";
20	20	import type { OperationBinding } from "./types";
	21	+import { testAccess } from "@executor-js/product-access/testing";
21	22
22	23	const RESPONSE_HEADERS_TIMEOUT_MS = 100;
23	24	const STREAM_TOOL = "logs.getLogs";
@@ -44,7 +45,9 @@ const testPlugins = () => · 20 unmodified lines
44	45
45	46	const buildExecutor = (baseUrl: string) =>
46	47	Effect.gen(function* () {
47		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	48	+ const executor = yield* createExecutor(
	49	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	50	+ );
48	51	yield* executor.openapi.addSpec(
49	52	makeOpenApiHttpApiTestIntegrationConfig(TimeoutApi, { slug: "headers_timeout", baseUrl }),
50	53	);

packages/plugins/openapi/src/sdk/spec-blob.test.ts+15−6

@@ -38,6 +38,7 @@ import { · 37 unmodified lines
38	38	serveOpenApiHttpApiTestServer,
39	39	unwrapInvocation,
40	40	} from "../testing";
	41	+import { testAccess } from "@executor-js/product-access/testing";
41	42
42	43	const testPlugins = (httpClientLayer = FetchHttpClient.layer) =>
43	44	[openApiPlugin({ httpClientLayer }), memoryCredentialsPlugin()] as const;
@@ -113,7 +114,9 @@ describe("OpenAPI plugin — spec blob storage", () => { · 69 unmodified lines
113	114	it.effect("addSpec stores a content pointer, not the inline spec text", () =>
114	115	Effect.scoped(
115	116	Effect.gen(function* () {
116		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	117	+ const executor = yield* createExecutor(
	118	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	119	+ );
117	120	const text = specText();
118	121
119	122	yield* executor.openapi.addSpec({
@@ -135,7 +138,9 @@ describe("OpenAPI plugin — spec blob storage", () => { · 15 unmodified lines
135	138	api: TestApi,
136	139	handlersLayer: EchoGroupLive,
137	140	});
138		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	141	+ const executor = yield* createExecutor(
	142	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	143	+ );
139	144
140	145	yield* executor.openapi.addSpec({
141	146	spec: { kind: "blob", value: server.specJson },
@@ -168,7 +173,7 @@ describe("OpenAPI plugin — spec blob storage", () => { · 26 unmodified lines
168	173	() =>
169	174	Effect.scoped(
170	175	Effect.gen(function* () {
171		− const config = makeTestConfig({ plugins: testPlugins() });
	176	+ const config = makeTestConfig({ access: testAccess.member(), plugins: testPlugins() });
172	177	const executor = yield* createExecutor(config);
173	178	const text = specTextWithDefinition();
174	179	const hash = yield* sha256Hex(text);
@@ -245,7 +250,7 @@ describe("OpenAPI plugin — spec blob storage", () => { · 70 unmodified lines
245	250	it.effect("stale sync preserves tools and definitions when the spec blob is missing", () =>
246	251	Effect.scoped(
247	252	Effect.gen(function* () {
248		− const config = makeTestConfig({ plugins: testPlugins() });
	253	+ const config = makeTestConfig({ access: testAccess.member(), plugins: testPlugins() });
249	254	const executor = yield* createExecutor(config);
250	255	const text = specTextWithDefinition();
251	256	const hash = yield* sha256Hex(text);
@@ -318,7 +323,9 @@ describe("OpenAPI plugin — spec blob storage", () => { · 66 unmodified lines
318	323	it.effect("explicit spec refresh accepts a valid OpenAPI document with zero operations", () =>
319	324	Effect.scoped(
320	325	Effect.gen(function* () {
321		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	326	+ const executor = yield* createExecutor(
	327	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	328	+ );
322	329	const emptySpec = JSON.stringify({
323	330	openapi: "3.1.0",
324	331	info: { title: "Empty", version: "1.0.0" },
@@ -409,7 +416,9 @@ describe("OpenAPI plugin — spec blob storage", () => { · 84 unmodified lines
409	416	it.effect("remove + re-add of the same spec is idempotent over the shared blob", () =>
410	417	Effect.scoped(
411	418	Effect.gen(function* () {
412		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	419	+ const executor = yield* createExecutor(
	420	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	421	+ );
413	422	const text = specText();
414	423
415	424	yield* executor.openapi.addSpec({ spec: { kind: "blob", value: text }, slug: "re_add" });

packages/plugins/openapi/src/sdk/spec-overrides-lifecycle.test.ts+10−3

@@ -9,6 +9,7 @@ import { makeTestConfig, memoryCredentialsPlugin } from "@executor-js/sdk/testin · 8 unmodified lines
9	9	import { openApiPlugin } from "./plugin";
10	10	import { applySpecOverrides, type SpecOverrides } from "./spec-overrides";
11	11	import { serveMutableOpenApiSpecTestServer } from "../testing";
	12	+import { testAccess } from "@executor-js/product-access/testing";
12	13
13	14	const testPlugins = () =>
14	15	[openApiPlugin({ httpClientLayer: FetchHttpClient.layer }), memoryCredentialsPlugin()] as const;
@@ -60,7 +61,9 @@ describe("OpenAPI spec override lifecycle", () => { · 45 unmodified lines
60	61	it.effect("applies scope overrides to preview and persists raw and patched hashes", () =>
61	62	Effect.scoped(
62	63	Effect.gen(function* () {
63		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	64	+ const executor = yield* createExecutor(
	65	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	66	+ );
64	67	const sourceText = encodeJsonText(oauthSpec);
65	68
66	69	const preview = yield* executor.openapi.previewSpec({
@@ -93,7 +96,9 @@ describe("OpenAPI spec override lifecycle", () => { · 26 unmodified lines
93	96	it.effect("changes and clears overrides for an inline spec without repasting the source", () =>
94	97	Effect.scoped(
95	98	Effect.gen(function* () {
96		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	99	+ const executor = yield* createExecutor(
	100	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	101	+ );
97	102	const sourceText = encodeJsonText(oauthSpec);
98	103	yield* executor.openapi.addSpec({
99	104	spec: { kind: "blob", value: sourceText },
@@ -130,7 +135,9 @@ describe("OpenAPI spec override lifecycle", () => { · 30 unmodified lines
130	135	.add(HttpApiEndpoint.post("create", "/items", { success: Schema.String }));
131	136	const InitialApi = HttpApi.make("initial").add(Items);
132	137	const server = yield* serveMutableOpenApiSpecTestServer({ initialApi: InitialApi });
133		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	138	+ const executor = yield* createExecutor(
	139	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	140	+ );
134	141	const removeList: SpecOverrides = [{ op: "remove", path: "/paths/~1items/get" }];
135	142
136	143	yield* executor.openapi.addSpec({

packages/plugins/openapi/src/sdk/streaming-response.test.ts+7−2

@@ -17,6 +17,7 @@ import { makeOpenApiHttpApiTestIntegrationConfig, unwrapInvocation } from "../te · 16 unmodified lines
17	17
18	18	import { collectStreamingBody, STREAM_MAX_BYTES } from "./invoke";
19	19	import { openApiPlugin } from "./plugin";
	20	+import { testAccess } from "@executor-js/product-access/testing";
20	21
21	22	const testPlugins = () =>
22	23	[openApiPlugin({ httpClientLayer: FetchHttpClient.layer }), memoryCredentialsPlugin()] as const;
@@ -35,7 +36,9 @@ const StreamingApi = HttpApi.make("streamingResponseTest") · 12 unmodified lines
35	36
36	37	const buildExecutor = (baseUrl: string) =>
37	38	Effect.gen(function* () {
38		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	39	+ const executor = yield* createExecutor(
	40	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	41	+ );
39	42	yield* executor.openapi.addSpec(
40	43	makeOpenApiHttpApiTestIntegrationConfig(StreamingApi, { slug: "streaming", baseUrl }),
41	44	);
@@ -293,7 +296,9 @@ describe("OpenAPI streaming responses", () => { · 251 unmodified lines
293	296	);
294	297	});
295	298
296		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	299	+ const executor = yield* createExecutor(
	300	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	301	+ );
297	302	yield* executor.openapi.addSpec({
298	303	spec: {
299	304	kind: "blob",

packages/plugins/openapi/src/sdk/tool-row-projection.test.ts+4−1

@@ -25,6 +25,7 @@ import { variable } from "@executor-js/sdk/http-auth"; · 24 unmodified lines
25	25
26	26	import { openApiPlugin } from "./plugin";
27	27	import { serveOpenApiHttpApiTestServer, unwrapInvocation } from "../testing";
	28	+import { testAccess } from "@executor-js/product-access/testing";
28	29
29	30	const testPlugins = (httpClientLayer = FetchHttpClient.layer) =>
30	31	[openApiPlugin({ httpClientLayer }), memoryCredentialsPlugin()] as const;
@@ -58,7 +59,9 @@ const setup = Effect.gen(function* () { · 27 unmodified lines
58	59	api: TestApi,
59	60	handlersLayer: EchoGroupLive,
60	61	});
61		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	62	+ const executor = yield* createExecutor(
	63	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	64	+ );
62	65	yield* executor.openapi.addSpec({
63	66	spec: { kind: "blob", value: server.specJson },
64	67	slug: "proj_api",

packages/plugins/openapi/src/sdk/upstream-failures.test.ts+8−3

@@ -48,6 +48,7 @@ import { · 47 unmodified lines
48	48	} from "../testing";
49	49
50	50	import { openApiPlugin } from "./plugin";
	51	+import { testAccess } from "@executor-js/product-access/testing";
51	52
52	53	class AdapterDefect extends Data.TaggedError("AdapterDefect") {}
53	54
@@ -149,7 +150,7 @@ const FailureApi = HttpApi.make("failuresTest") · 95 unmodified lines
149	150	const buildExecutor = (baseUrl: string, httpClientLayer = FetchHttpClient.layer) =>
150	151	Effect.gen(function* () {
151	152	const executor = yield* createExecutor(
152		− makeTestConfig({ plugins: testPlugins(httpClientLayer) }),
	153	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins(httpClientLayer) }),
153	154	);
154	155	yield* executor.openapi.addSpec(
155	156	makeOpenApiHttpApiTestIntegrationConfig(FailureApi, { slug: "f", baseUrl }),
@@ -167,7 +168,9 @@ const buildExecutor = (baseUrl: string, httpClientLayer = FetchHttpClient.layer) · 11 unmodified lines
167	168
168	169	const buildExecutorForOpenApiServer = (server: OpenApiTestServerShape) =>
169	170	Effect.gen(function* () {
170		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	171	+ const executor = yield* createExecutor(
	172	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	173	+ );
171	174	const conn = yield* addOpenApiTestConnection(executor, server, { slug: "f" });
172	175	return { executor, address: conn.address(LIST_THINGS) };
173	176	});
@@ -349,7 +352,9 @@ describe("OpenAPI upstream failure modes", () => { · 175 unmodified lines
349	352	headers: { "content-type": "application/json" },
350	353	body: '{"error":{"status":"PERMISSION_DENIED","details":[{"reason":"ACCESS_TOKEN_SCOPE_INSUFFICIENT"}]}}',
351	354	}));
352		− const executor = yield* createExecutor(makeTestConfig({ plugins: testPlugins() }));
	355	+ const executor = yield* createExecutor(
	356	+ makeTestConfig({ access: testAccess.member(), plugins: testPlugins() }),
	357	+ );
353	358	// Declare the operation's scope in the spec blob before registering it,
354	359	// so the extracted binding carries requiredScopes.
355	360	const SpecJson = Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown));