import * as NodeServices from "@effect/platform-node/NodeServices";import { describe, expect, it } from "@effect/vitest";import * as Effect from "effect/Effect";import * as Option from "effect/Option";import * as PlatformError from "effect/PlatformError";import * as Tracer from "effect/Tracer";import { HttpClient, HttpServerRequest } from "effect/unstable/http"; import { RelayClientTracer } from "@t3tools/shared/relayTracing";import * as EnvironmentAuth from "../auth/EnvironmentAuth.ts";import * as ServerSecretStore from "../auth/ServerSecretStore.ts";import { ServerEnvironment } from "../environment/Services/ServerEnvironment.ts";import * as CliTokenManager from "./CliTokenManager.ts";import { consumeCloudReplayGuards, reconcileDesiredCloudLink } from "./http.ts";import { CloudManagedEndpointRuntime, type CloudManagedEndpointRuntimeShape,} from "./ManagedEndpointRuntime.ts";import { traceAuthenticatedRelayRequest, traceRelayRequest } from "./traceRelayRequest.ts"; const storeFailure = (tag: "AlreadyExists" | "PermissionDenied") => new ServerSecretStore.SecretStoreError({ message: "Failed to persist cloud replay guard.", cause: PlatformError.systemError({ _tag: tag, module: "FileSystem", method: "open", pathOrDescriptor: "cloud-replay-guard.bin", }), }); const unusedSecretStoreOperation = () => Effect.die("unused secret-store operation"); function makeSecretStore( create: ServerSecretStore.ServerSecretStoreShape["create"],): ServerSecretStore.ServerSecretStoreShape { return { get: unusedSecretStoreOperation, set: unusedSecretStoreOperation, create, getOrCreateRandom: unusedSecretStoreOperation, remove: unusedSecretStoreOperation, };} describe("consumeCloudReplayGuards", () => { it.effect("reports already-created guards as replay conflicts", () => Effect.gen(function* () { const consumed = yield* consumeCloudReplayGuards({ secrets: makeSecretStore(() => Effect.fail(storeFailure("AlreadyExists"))), names: ["cloud-jti", "cloud-nonce"], value: new Uint8Array(), }); expect(consumed).toBe(false); }), ); it.effect("preserves replay-store availability failures", () => Effect.gen(function* () { const failure = storeFailure("PermissionDenied"); const error = yield* Effect.flip( consumeCloudReplayGuards({ secrets: makeSecretStore(() => Effect.fail(failure)), names: ["cloud-jti", "cloud-nonce"], value: new Uint8Array(), }), ); expect(error).toBe(failure); }), );}); describe("relay request tracing", () => { it.effect("does not accept an unauthenticated request trace parent", () => Effect.gen(function* () { const spans: Array<Tracer.Span> = []; const productTracer = Tracer.make({ span: (options) => { const span = new Tracer.NativeSpan(options); spans.push(span); return span; }, }); const request = HttpServerRequest.fromWeb( new Request("https://environment.example.test/api/t3-cloud/mint-credential", { headers: { traceparent: "00-0123456789abcdef0123456789abcdef-0123456789abcdef-01", }, }), ); yield* traceRelayRequest(Effect.void.pipe(Effect.withSpan("relay.mint.handler"))).pipe( Effect.provideService(HttpServerRequest.HttpServerRequest, request), Effect.provideService(RelayClientTracer, Option.some(productTracer)), ); expect(spans).toHaveLength(1); const span = spans[0]!; expect(span.traceId).not.toBe("0123456789abcdef0123456789abcdef"); expect(Option.isNone(span.parent)).toBe(true); }), ); it.effect("continues an authenticated relay trace with the product tracer", () => Effect.gen(function* () { const spans: Array<Tracer.Span> = []; const productTracer = Tracer.make({ span: (options) => { const span = new Tracer.NativeSpan(options); spans.push(span); return span; }, }); const request = HttpServerRequest.fromWeb( new Request("https://environment.example.test/api/t3-cloud/mint-credential", { headers: { traceparent: "00-0123456789abcdef0123456789abcdef-0123456789abcdef-01", }, }), ); yield* traceAuthenticatedRelayRequest( Effect.void.pipe(Effect.withSpan("relay.mint.handler")), ).pipe( Effect.provideService(HttpServerRequest.HttpServerRequest, request), Effect.provideService(RelayClientTracer, Option.some(productTracer)), ); expect(spans).toHaveLength(1); const span = spans[0]!; expect(span.traceId).toBe("0123456789abcdef0123456789abcdef"); expect(Option.getOrUndefined(span.parent)?.spanId).toBe("0123456789abcdef"); }), );}); describe("reconcileDesiredCloudLink", () => { it.effect("requires stored CLI authorization without exposing an HTTP endpoint", () => Effect.gen(function* () { const error = yield* Effect.flip(reconcileDesiredCloudLink("http://127.0.0.1:3774")); expect(error).toMatchObject({ _tag: "EnvironmentHttpUnauthorizedError", message: "Run `t3 connect link` to authorize this environment.", }); }).pipe( Effect.provideService( ServerSecretStore.ServerSecretStore, makeSecretStore(unusedSecretStoreOperation), ), Effect.provideService( ServerEnvironment, ServerEnvironment.of({ getEnvironmentId: unusedSecretStoreOperation(), getDescriptor: unusedSecretStoreOperation(), }), ), Effect.provideService( CloudManagedEndpointRuntime, CloudManagedEndpointRuntime.of({ applyConfig: unusedSecretStoreOperation, } satisfies CloudManagedEndpointRuntimeShape), ), Effect.provideService( EnvironmentAuth.EnvironmentAuth, EnvironmentAuth.EnvironmentAuth.of({} as EnvironmentAuth.EnvironmentAuthShape), ), Effect.provideService( CliTokenManager.CloudCliTokenManager, CliTokenManager.CloudCliTokenManager.of({ get: unusedSecretStoreOperation(), getExisting: Effect.succeed(Option.none()), hasCredential: unusedSecretStoreOperation(), clear: unusedSecretStoreOperation(), }), ), Effect.provideService( HttpClient.HttpClient, HttpClient.make(() => unusedSecretStoreOperation()), ), Effect.provide(NodeServices.layer), ), );});
import * as NodeServices from "@effect/platform-node/NodeServices";
import { describe, expect, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Option from "effect/Option";
import * as PlatformError from "effect/PlatformError";
import * as Tracer from "effect/Tracer";
import { HttpClient, HttpServerRequest } from "effect/unstable/http";
import { RelayClientTracer } from "@t3tools/shared/relayTracing";
import * as EnvironmentAuth from "../auth/EnvironmentAuth.ts";
import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
import { ServerEnvironment } from "../environment/Services/ServerEnvironment.ts";
import * as CliTokenManager from "./CliTokenManager.ts";
import { consumeCloudReplayGuards, reconcileDesiredCloudLink } from "./http.ts";
import {
CloudManagedEndpointRuntime,
type CloudManagedEndpointRuntimeShape,
} from "./ManagedEndpointRuntime.ts";
import { traceAuthenticatedRelayRequest, traceRelayRequest } from "./traceRelayRequest.ts";
const storeFailure = (tag: "AlreadyExists" | "PermissionDenied") =>
new ServerSecretStore.SecretStoreError({
message: "Failed to persist cloud replay guard.",
cause: PlatformError.systemError({
_tag: tag,
module: "FileSystem",
method: "open",
pathOrDescriptor: "cloud-replay-guard.bin",
}),
});
const unusedSecretStoreOperation = () => Effect.die("unused secret-store operation");
function makeSecretStore(
create: ServerSecretStore.ServerSecretStoreShape["create"],
): ServerSecretStore.ServerSecretStoreShape {
return {
get: unusedSecretStoreOperation,
set: unusedSecretStoreOperation,
create,
getOrCreateRandom: unusedSecretStoreOperation,
remove: unusedSecretStoreOperation,
};
}
describe("consumeCloudReplayGuards", () => {
it.effect("reports already-created guards as replay conflicts", () =>
Effect.gen(function* () {
const consumed = yield* consumeCloudReplayGuards({
secrets: makeSecretStore(() => Effect.fail(storeFailure("AlreadyExists"))),
names: ["cloud-jti", "cloud-nonce"],
value: new Uint8Array(),
});
expect(consumed).toBe(false);
}),
);
it.effect("preserves replay-store availability failures", () =>
Effect.gen(function* () {
const failure = storeFailure("PermissionDenied");
const error = yield* Effect.flip(
consumeCloudReplayGuards({
secrets: makeSecretStore(() => Effect.fail(failure)),
names: ["cloud-jti", "cloud-nonce"],
value: new Uint8Array(),
}),
);
expect(error).toBe(failure);
}),
);
});
describe("relay request tracing", () => {
it.effect("does not accept an unauthenticated request trace parent", () =>
Effect.gen(function* () {
const spans: Array<Tracer.Span> = [];
const productTracer = Tracer.make({
span: (options) => {
const span = new Tracer.NativeSpan(options);
spans.push(span);
return span;
},
});
const request = HttpServerRequest.fromWeb(
new Request("https://environment.example.test/api/t3-cloud/mint-credential", {
headers: {
traceparent: "00-0123456789abcdef0123456789abcdef-0123456789abcdef-01",
},
}),
);
yield* traceRelayRequest(Effect.void.pipe(Effect.withSpan("relay.mint.handler"))).pipe(
Effect.provideService(HttpServerRequest.HttpServerRequest, request),
Effect.provideService(RelayClientTracer, Option.some(productTracer)),
);
expect(spans).toHaveLength(1);
const span = spans[0]!;
expect(span.traceId).not.toBe("0123456789abcdef0123456789abcdef");
expect(Option.isNone(span.parent)).toBe(true);
}),
);
it.effect("continues an authenticated relay trace with the product tracer", () =>
Effect.gen(function* () {
const spans: Array<Tracer.Span> = [];
const productTracer = Tracer.make({
span: (options) => {
const span = new Tracer.NativeSpan(options);
spans.push(span);
return span;
},
});
const request = HttpServerRequest.fromWeb(
new Request("https://environment.example.test/api/t3-cloud/mint-credential", {
headers: {
traceparent: "00-0123456789abcdef0123456789abcdef-0123456789abcdef-01",
},
}),
);
yield* traceAuthenticatedRelayRequest(
Effect.void.pipe(Effect.withSpan("relay.mint.handler")),
).pipe(
Effect.provideService(HttpServerRequest.HttpServerRequest, request),
Effect.provideService(RelayClientTracer, Option.some(productTracer)),
);
expect(spans).toHaveLength(1);
const span = spans[0]!;
expect(span.traceId).toBe("0123456789abcdef0123456789abcdef");
expect(Option.getOrUndefined(span.parent)?.spanId).toBe("0123456789abcdef");
}),
);
});
describe("reconcileDesiredCloudLink", () => {
it.effect("requires stored CLI authorization without exposing an HTTP endpoint", () =>
Effect.gen(function* () {
const error = yield* Effect.flip(reconcileDesiredCloudLink("http://127.0.0.1:3774"));
expect(error).toMatchObject({
_tag: "EnvironmentHttpUnauthorizedError",
message: "Run `t3 connect link` to authorize this environment.",
});
}).pipe(
Effect.provideService(
ServerSecretStore.ServerSecretStore,
makeSecretStore(unusedSecretStoreOperation),
),
Effect.provideService(
ServerEnvironment,
ServerEnvironment.of({
getEnvironmentId: unusedSecretStoreOperation(),
getDescriptor: unusedSecretStoreOperation(),
}),
),
Effect.provideService(
CloudManagedEndpointRuntime,
CloudManagedEndpointRuntime.of({
applyConfig: unusedSecretStoreOperation,
} satisfies CloudManagedEndpointRuntimeShape),
),
Effect.provideService(
EnvironmentAuth.EnvironmentAuth,
EnvironmentAuth.EnvironmentAuth.of({} as EnvironmentAuth.EnvironmentAuthShape),
),
Effect.provideService(
CliTokenManager.CloudCliTokenManager,
CliTokenManager.CloudCliTokenManager.of({
get: unusedSecretStoreOperation(),
getExisting: Effect.succeed(Option.none()),
hasCredential: unusedSecretStoreOperation(),
clear: unusedSecretStoreOperation(),
}),
),
Effect.provideService(
HttpClient.HttpClient,
HttpClient.make(() => unusedSecretStoreOperation()),
),
Effect.provide(NodeServices.layer),
),
);
});