import { EnvironmentId } from "@t3tools/contracts";import { RelayEnvironmentStatusScope } from "@t3tools/contracts/relay";import { describe, expect, it } from "@effect/vitest";import * as Duration from "effect/Duration";import * as Effect from "effect/Effect";import * as Fiber from "effect/Fiber";import * as Layer from "effect/Layer";import * as Tracer from "effect/Tracer";import * as TestClock from "effect/testing/TestClock"; import * as ManagedRelay from "./managedRelay.ts";import { remoteHttpClientLayer } from "../rpc/http.ts"; function managedRelayTestLayer(  fetchFn: typeof globalThis.fetch,  relayUrl = "https://relay.example.test",  accessTokenStore?: ManagedRelay.ManagedRelayAccessTokenStore,  signer: ManagedRelay.ManagedRelayDpopSigner["Service"] = {    thumbprint: Effect.succeed("client-thumbprint"),    createProof: (input) => Effect.succeed(`proof:${input.url}`),  },) {  const httpClientLayer = remoteHttpClientLayer(fetchFn);  const signerLayer = Layer.succeed(    ManagedRelay.ManagedRelayDpopSigner,    ManagedRelay.ManagedRelayDpopSigner.of(signer),  );  return ManagedRelay.layer({    relayUrl,    clientId: "t3-mobile",    ...(accessTokenStore ? { accessTokenStore } : {}),  }).pipe(Layer.provide(signerLayer), Layer.provide(httpClientLayer));} function clerkToken(subject: string, nonce: string): string {  const encode = (value: unknown) =>    btoa(JSON.stringify(value)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");  return `${encode({ alg: "none" })}.${encode({ sub: subject, nonce })}.signature`;} describe("ManagedRelayClient", () => {  it("redacts relay URLs and DPoP targets while preserving causes", () => {    const relayUrl =      "http://relay-user:relay-password@relay.example.test/private/workspace?access_token=relay-secret#relay-fragment";    const dpopTarget =      "https://dpop-user:dpop-password@relay.example.test/v1/client/dpop-token?access_token=dpop-secret#dpop-fragment";    const cause = new Error("proof failed");    const invalidUrlError = ManagedRelay.ManagedRelayUrlInvalidError.fromInput(relayUrl);    const proofErrors = [      ManagedRelay.ManagedRelayDpopKeyLoadError.fromTarget({        keyStore: "indexed-db",        method: "POST",        url: dpopTarget,        cause,      }),      ManagedRelay.ManagedRelayDpopProofCreationError.fromTarget({        method: "POST",        url: dpopTarget,        cause,      }),      ManagedRelay.ManagedRelayTokenProofCreationError.fromTarget({        method: "POST",        url: dpopTarget,        cause,      }),      ManagedRelay.ManagedRelayRequestProofCreationError.fromTarget({        method: "POST",        url: dpopTarget,        cause,      }),    ];     expect(invalidUrlError).toMatchObject({      relayUrlInputLength: relayUrl.length,      relayUrlProtocol: "http:",      relayUrlHostname: "relay.example.test",    });    const invalidUrlDiagnostics = JSON.stringify(invalidUrlError);    for (const secret of [      "relay-user",      "relay-password",      "/private/workspace",      "relay-secret",      "relay-fragment",    ]) {      expect(invalidUrlDiagnostics).not.toContain(secret);      expect(invalidUrlError.message).not.toContain(secret);    }     for (const error of proofErrors) {      expect(error.requestTarget).toBe("https://relay.example.test/v1/client/dpop-token");      expect(error.cause).toBe(cause);      const diagnostics = JSON.stringify(error);      for (const secret of ["dpop-user", "dpop-password", "dpop-secret", "dpop-fragment"]) {        expect(diagnostics).not.toContain(secret);        expect(error.message).not.toContain(secret);      }    }  });   it.effect("owns tracing at service and implementation boundaries", () => {    const spanNames: Array<string> = [];    const tracer = Tracer.make({      span: (options) => {        const span = new Tracer.NativeSpan(options);        spanNames.push(span.name);        return span;      },    });    const fetchFn = ((input) => {      const url = String(input);      if (url.endsWith("/v1/client/dpop-token")) {        return Promise.resolve(          Response.json({            access_token: "relay-token",            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 1_800,            scope: RelayEnvironmentStatusScope,          }),        );      }      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-06-05T20:00:00.000Z",          descriptor: {            environmentId: "env-1",            label: "Desktop",            platform: { os: "darwin", arch: "arm64" },            serverVersion: "0.0.0-test",            capabilities: { repositoryIdentity: true },          },        }),      );    }) satisfies typeof globalThis.fetch;     return Effect.gen(function* () {      const relayClient = yield* ManagedRelay.ManagedRelayClient;      yield* relayClient.getEnvironmentStatus({        clerkToken: clerkToken("user-1", "session-1"),        scopes: [RelayEnvironmentStatusScope],        environmentId: EnvironmentId.make("env-1"),      });       expect(spanNames).toEqual(        expect.arrayContaining([          "clientRuntime.managedRelay.getEnvironmentStatus",          "clientRuntime.managedRelay.authorize",          "clientRuntime.managedRelay.obtainAccessToken",          "clientRuntime.managedRelay.tokenCacheCriticalSection",          "clientRuntime.managedRelay.exchangeAccessToken",        ]),      );      expect(spanNames).not.toEqual(        expect.arrayContaining([          "clientRuntime.managedRelay.createTokenExchangeProof",          "clientRuntime.managedRelay.exchangeAccessTokenRequest",          "clientRuntime.managedRelay.createRequestProof",        ]),      );    }).pipe(Effect.withTracer(tracer), Effect.provide(managedRelayTestLayer(fetchFn)));  });   it.effect("rejects unsafe relay URLs before sending credentials", () => {    let requestCount = 0;    const fetchFn = (() => {      requestCount += 1;      return Promise.resolve(Response.json({}));    }) satisfies typeof globalThis.fetch;     return Effect.gen(function* () {      const relayClient = yield* ManagedRelay.ManagedRelayClient;      const error = yield* relayClient        .listEnvironments({ clerkToken: "clerk-token" })        .pipe(Effect.flip);       expect(error).toMatchObject({        _tag: "ManagedRelayUrlInvalidError",        relayUrlInputLength: "http://relay.example.test".length,        relayUrlProtocol: "http:",        relayUrlHostname: "relay.example.test",        message: "Relay URL must be a secure absolute HTTPS origin.",      });      expect(requestCount).toBe(0);    }).pipe(Effect.provide(managedRelayTestLayer(fetchFn, "http://relay.example.test")));  });   it.effect("preserves key-load failures when creating a token proof", () => {    const keyStoreCause = new Error("IndexedDB unavailable");    const fetchFn = (() => Promise.resolve(Response.json({}))) satisfies typeof globalThis.fetch;     return Effect.gen(function* () {      const relayClient = yield* ManagedRelay.ManagedRelayClient;      const error = yield* relayClient        .getEnvironmentStatus({          clerkToken: clerkToken("user-1", "session-1"),          scopes: [RelayEnvironmentStatusScope],          environmentId: EnvironmentId.make("env-1"),        })        .pipe(Effect.flip);       expect(error).toMatchObject({        _tag: "ManagedRelayTokenProofCreationError",        cause: {          _tag: "ManagedRelayDpopKeyLoadError",          keyStore: "indexed-db",          method: "POST",          message: "Could not load relay DPoP proof key.",          cause: keyStoreCause,        },      });    }).pipe(      Effect.provide(        managedRelayTestLayer(fetchFn, undefined, undefined, {          thumbprint: Effect.succeed("client-thumbprint"),          createProof: (input) =>            Effect.fail(              ManagedRelay.ManagedRelayDpopKeyLoadError.fromTarget({                keyStore: "indexed-db",                method: input.method,                url: input.url,                cause: keyStoreCause,              }),            ),        }),      ),    );  });   it.effect("reuses usable DPoP tokens and refreshes cleared or expiring cache entries", () => {    let tokenExchangeCount = 0;    const fetchFn = ((input) => {      const url = String(input);      if (url.endsWith("/v1/client/dpop-token")) {        tokenExchangeCount += 1;        return Promise.resolve(          Response.json({            access_token: `relay-token-${tokenExchangeCount}`,            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 10,            scope: RelayEnvironmentStatusScope,          }),        );      }      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-05-25T00:01:00.000Z",          descriptor: {            environmentId: "env-1",            label: "Desktop",            platform: { os: "darwin", arch: "arm64" },            serverVersion: "0.0.0-test",            capabilities: { repositoryIdentity: true },          },        }),      );    }) satisfies typeof globalThis.fetch;     return Effect.gen(function* () {      const relayClient = yield* ManagedRelay.ManagedRelayClient;      const statusInput = {        clerkToken: clerkToken("user-1", "session-1"),        scopes: [RelayEnvironmentStatusScope],        environmentId: EnvironmentId.make("env-1"),      } as const;       yield* relayClient.getEnvironmentStatus(statusInput);      yield* relayClient.getEnvironmentStatus(statusInput);      expect(tokenExchangeCount).toBe(1);       yield* TestClock.adjust(Duration.seconds(6));      yield* relayClient.getEnvironmentStatus(statusInput);      expect(tokenExchangeCount).toBe(2);       yield* relayClient.resetTokenCache;      yield* relayClient.getEnvironmentStatus(statusInput);      expect(tokenExchangeCount).toBe(3);    }).pipe(Effect.provide(managedRelayTestLayer(fetchFn)));  });   it.effect("reuses a persisted token across runtimes and Clerk session token rotation", () => {    let tokenExchangeCount = 0;    let persistedTokens: ReadonlyArray<ManagedRelay.ManagedRelayAccessTokenCacheEntry> = [];    const accessTokenStore: ManagedRelay.ManagedRelayAccessTokenStore = {      load: Effect.sync(() => persistedTokens),      save: (entries) =>        Effect.sync(() => {          persistedTokens = entries;        }),      clear: Effect.sync(() => {        persistedTokens = [];      }),    };    const fetchFn = ((input) => {      const url = String(input);      if (url.endsWith("/v1/client/dpop-token")) {        tokenExchangeCount += 1;        return Promise.resolve(          Response.json({            access_token: "persisted-relay-token",            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 1_800,            scope: RelayEnvironmentStatusScope,          }),        );      }      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-06-05T20:00:00.000Z",          descriptor: {            environmentId: "env-1",            label: "Desktop",            platform: { os: "darwin", arch: "arm64" },            serverVersion: "0.0.0-test",            capabilities: { repositoryIdentity: true },          },        }),      );    }) satisfies typeof globalThis.fetch;    const statusInput = (token: string) =>      ({        clerkToken: token,        scopes: [RelayEnvironmentStatusScope],        environmentId: EnvironmentId.make("env-1"),      }) as const;     return Effect.gen(function* () {      yield* Effect.gen(function* () {        const relayClient = yield* ManagedRelay.ManagedRelayClient;        yield* relayClient.getEnvironmentStatus(statusInput(clerkToken("user-1", "session-1")));      }).pipe(Effect.provide(managedRelayTestLayer(fetchFn, undefined, accessTokenStore)));       expect(tokenExchangeCount).toBe(1);      expect(persistedTokens).toHaveLength(1);       yield* Effect.gen(function* () {        const relayClient = yield* ManagedRelay.ManagedRelayClient;        yield* relayClient.getEnvironmentStatus(statusInput(clerkToken("user-1", "session-2")));      }).pipe(Effect.provide(managedRelayTestLayer(fetchFn, undefined, accessTokenStore)));       expect(tokenExchangeCount).toBe(1);    });  });   it.effect("refreshes a persisted DPoP token once when the relay rejects it", () => {    let tokenExchangeCount = 0;    const statusTokens: Array<string | null> = [];    let persistedTokens: ReadonlyArray<ManagedRelay.ManagedRelayAccessTokenCacheEntry> = [      {        accountId: "user-1",        clientId: "t3-mobile",        relayUrl: "https://relay.example.test",        thumbprint: "client-thumbprint",        scopes: [RelayEnvironmentStatusScope],        accessToken: "stale-relay-token",        expiresAtMillis: Number.MAX_SAFE_INTEGER,      },    ];    const accessTokenStore: ManagedRelay.ManagedRelayAccessTokenStore = {      load: Effect.sync(() => persistedTokens),      save: (entries) =>        Effect.sync(() => {          persistedTokens = entries;        }),      clear: Effect.sync(() => {        persistedTokens = [];      }),    };    const fetchFn = ((input, init) => {      const url = String(input);      if (url.endsWith("/v1/client/dpop-token")) {        tokenExchangeCount += 1;        return Promise.resolve(          Response.json({            access_token: "fresh-relay-token",            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 1_800,            scope: RelayEnvironmentStatusScope,          }),        );      }       const authorization = new Headers(init?.headers).get("authorization");      statusTokens.push(authorization);      if (authorization === "DPoP stale-relay-token") {        return Promise.resolve(          Response.json(            {              _tag: "RelayAuthInvalidError",              code: "auth_invalid",              reason: "invalid_bearer",              traceId: "trace-stale-token",            },            { status: 401 },          ),        );      }      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-06-05T20:00:00.000Z",          descriptor: {            environmentId: "env-1",            label: "Desktop",            platform: { os: "darwin", arch: "arm64" },            serverVersion: "0.0.0-test",            capabilities: { repositoryIdentity: true },          },        }),      );    }) satisfies typeof globalThis.fetch;     return Effect.gen(function* () {      const relayClient = yield* ManagedRelay.ManagedRelayClient;      const result = yield* relayClient.getEnvironmentStatus({        clerkToken: clerkToken("user-1", "session-1"),        scopes: [RelayEnvironmentStatusScope],        environmentId: EnvironmentId.make("env-1"),      });       expect(result.status).toBe("online");      expect(statusTokens).toEqual(["DPoP stale-relay-token", "DPoP fresh-relay-token"]);      expect(tokenExchangeCount).toBe(1);      expect(persistedTokens).toMatchObject([        {          accessToken: "fresh-relay-token",        },      ]);    }).pipe(Effect.provide(managedRelayTestLayer(fetchFn, undefined, accessTokenStore)));  });   it.effect("does not persist tokens when the Clerk subject cannot be decoded", () => {    let persistedTokens: ReadonlyArray<ManagedRelay.ManagedRelayAccessTokenCacheEntry> = [];    const accessTokenStore: ManagedRelay.ManagedRelayAccessTokenStore = {      load: Effect.succeed([]),      save: (entries) =>        Effect.sync(() => {          persistedTokens = entries;        }),      clear: Effect.void,    };    const fetchFn = ((input) => {      const url = String(input);      if (url.endsWith("/v1/client/dpop-token")) {        return Promise.resolve(          Response.json({            access_token: "relay-token",            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 1_800,            scope: RelayEnvironmentStatusScope,          }),        );      }      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-06-05T20:00:00.000Z",          descriptor: {            environmentId: "env-1",            label: "Desktop",            platform: { os: "darwin", arch: "arm64" },            serverVersion: "0.0.0-test",            capabilities: { repositoryIdentity: true },

Lines 1–500 of 614. Load more