Clean cloud auth and Autumn boundaries

Rhys Sullivan committed 6 months ago

Commit d401d651 parent b039b6e4 files · +36 −22Browse files

Unified · Split

4 files

 import { env } from "cloudflare:workers";
-import { Effect } from "effect";
+import { Cause, Effect } from "effect";
 import {
   HttpRouter,
   HttpServerRequest,
   const session = yield* workos.authenticateRequest(webRequest);
   if (!session || !session.organizationId) {
-    return yield* Effect.fail(
+    return yield* new HttpResponseError({
-      new HttpResponseError({
+      status: 401,
-        status: 401,
+      code: "unauthorized",
-        code: "unauthorized",
+      message: "Unauthorized",
-        message: "Unauthorized",
+    });
-      }),
-    );
   }
   const url = new URL(webRequest.url);
   if (statusCode >= 400) {
     console.error("[autumn] upstream error:", statusCode, response);
-    return yield* Effect.fail(
+    return yield* new HttpResponseError({
-      new HttpResponseError({
+      status: statusCode,
-        status: statusCode,
+      code: "billing_request_failed",
-        code: "billing_request_failed",
+      message: "Billing request failed",
-        message: "Billing request failed",
+    });
-      }),
-    );
   }
   return HttpServerResponse.jsonUnsafe(response, { status: statusCode });
 }).pipe(
   Effect.catchCause((err) => {
     if (isServerError(err)) {
-      console.error("[autumn] request failed:", err instanceof Error ? err.stack : err);
+      console.error("[autumn] request failed:", Cause.pretty(err));
     }
     return Effect.succeed(toErrorServerResponse(err));
   }),

 import { HttpApiBuilder, HttpApi } from "effect/unstable/httpapi";
 import { HttpRouter, HttpServer } from "effect/unstable/http";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Layer } from "effect";
+import { Data, Effect, Layer } from "effect";
 import type { Effect as EffectType } from "effect/Effect";
 import { CloudAuthPublicApi } from "./api";
   metadata: {},
 };
+class UnstubbedWorkOSMethod extends Data.TaggedError("UnstubbedWorkOSMethod")<{
+  method: string;
+}> {}
 const makeAuthFetch = (workos: Partial<WorkOSAuth["Service"]>) => {
   const WorkOSTest = Layer.succeed(
     WorkOSAuth,
     new Proxy(workos as WorkOSAuth["Service"], {
       get: (target, prop) => {
         if (prop in target) return target[prop as keyof typeof target];
-        return () => {
+        return () =>
-          throw new Error(`WorkOSAuth.${String(prop)} not stubbed`);
+          Effect.fail(
-        };
+            new UnstubbedWorkOSMethod({
+              method: typeof prop === "string" ? prop : (prop.description ?? "symbol"),
+            }),
+          );
       },
     }),
   );

 // ---------------------------------------------------------------------------
 import { env } from "cloudflare:workers";
-import { Context, Effect, Layer } from "effect";
+import { Context, Data, Effect, Layer } from "effect";
 import { GeneratePortalLinkIntent, WorkOS } from "@workos-inc/node/worker";
 import { WorkOSError, tryPromiseService, withServiceLogging } from "./errors";
 const COOKIE_NAME = "wos-session";
+const INVALID_COOKIE_PASSWORD_MESSAGE =
+  "WORKOS_COOKIE_PASSWORD must be at least 32 characters";
+class WorkOSAuthConfigurationError extends Data.TaggedError("WorkOSAuthConfigurationError")<{
+  readonly message: string;
+}> {}
 // ---------------------------------------------------------------------------
 // Service
   const cookiePassword = env.WORKOS_COOKIE_PASSWORD;
   if (!cookiePassword || cookiePassword.length < 32) {
-    return yield* Effect.die(new Error("WORKOS_COOKIE_PASSWORD must be at least 32 characters"));
+    return yield* new WorkOSAuthConfigurationError({
+      message: INVALID_COOKIE_PASSWORD_MESSAGE,
+    });
   }
   const workos = new WorkOS({ apiKey, clientId });

     // Reproduces the production chain: an inner runPromise rejects with a
     // CauseImpl (from Effect v4's causeSquash), Effect.promise re-wraps it
     // as Die(CauseImpl), and the outer catchCause receives this shape.
+    // oxlint-disable-next-line executor/no-error-constructor -- boundary: observability test must build a real Error for Sentry-compatible payload assertions
     const innerCause = Cause.fail(new Error("inner failure"));
     const outerCause = Cause.die(innerCause);
   });
   it("hands Sentry a real Error for an ordinary failed Cause", () => {
+    // oxlint-disable-next-line executor/no-error-constructor -- boundary: observability test must build a real Error for Sentry-compatible payload assertions
     const { primary } = sentryPayloadForCause(Cause.fail(new Error("plain failure")));
     expect(looksLikeErrorToSentry(primary)).toBe(true);
   });
   it("forwards non-Cause inputs as-is with no pretty cause attached", () => {
+    // oxlint-disable-next-line executor/no-error-constructor -- boundary: observability test must build a real Error for Sentry-compatible payload assertions
     const err = new Error("raw");
     const { primary, pretty } = sentryPayloadForCause(err);
     expect(primary).toBe(err);