import * as NodeServices from "@effect/platform-node/NodeServices";import { describe, expect, it } from "@effect/vitest";import * as Effect from "effect/Effect";import * as Option from "effect/Option";import * as PlatformError from "effect/PlatformError";import * as Tracer from "effect/Tracer";import { HttpClient, HttpServerRequest } from "effect/unstable/http"; import { RelayClientTracer } from "@t3tools/shared/relayTracing";import * as EnvironmentAuth from "../auth/EnvironmentAuth.ts";import * as ServerSecretStore from "../auth/ServerSecretStore.ts";import { ServerEnvironment } from "../environment/Services/ServerEnvironment.ts";import * as CliTokenManager from "./CliTokenManager.ts";import {  consumeCloudReplayGuards,  reconcileDesiredCloudLink,  traceRelayBrokerHandler,} from "./http.ts";import {  CloudManagedEndpointRuntime,  type CloudManagedEndpointRuntimeShape,} from "./ManagedEndpointRuntime.ts"; const storeFailure = (tag: "AlreadyExists" | "PermissionDenied") =>  new ServerSecretStore.SecretStoreError({    message: "Failed to persist cloud replay guard.",    cause: PlatformError.systemError({      _tag: tag,      module: "FileSystem",      method: "open",      pathOrDescriptor: "cloud-replay-guard.bin",    }),  }); const unusedSecretStoreOperation = () => Effect.die("unused secret-store operation"); function makeSecretStore(  create: ServerSecretStore.ServerSecretStoreShape["create"],): ServerSecretStore.ServerSecretStoreShape {  return {    get: unusedSecretStoreOperation,    set: unusedSecretStoreOperation,    create,    getOrCreateRandom: unusedSecretStoreOperation,    remove: unusedSecretStoreOperation,  };} describe("consumeCloudReplayGuards", () => {  it.effect("reports already-created guards as replay conflicts", () =>    Effect.gen(function* () {      const consumed = yield* consumeCloudReplayGuards({        secrets: makeSecretStore(() => Effect.fail(storeFailure("AlreadyExists"))),        names: ["cloud-jti", "cloud-nonce"],        value: new Uint8Array(),      });       expect(consumed).toBe(false);    }),  );   it.effect("preserves replay-store availability failures", () =>    Effect.gen(function* () {      const failure = storeFailure("PermissionDenied");      const error = yield* Effect.flip(        consumeCloudReplayGuards({          secrets: makeSecretStore(() => Effect.fail(failure)),          names: ["cloud-jti", "cloud-nonce"],          value: new Uint8Array(),        }),      );       expect(error).toBe(failure);    }),  );}); describe("traceRelayBrokerHandler", () => {  it.effect("continues the incoming relay trace with the product tracer", () =>    Effect.gen(function* () {      const spans: Array<Tracer.Span> = [];      const productTracer = Tracer.make({        span: (options) => {          const span = new Tracer.NativeSpan(options);          spans.push(span);          return span;        },      });      const request = HttpServerRequest.fromWeb(        new Request("https://environment.example.test/api/t3-cloud/mint-credential", {          headers: {            traceparent: "00-0123456789abcdef0123456789abcdef-0123456789abcdef-01",          },        }),      );       yield* traceRelayBrokerHandler(Effect.void.pipe(Effect.withSpan("relay.mint.handler"))).pipe(        Effect.provideService(HttpServerRequest.HttpServerRequest, request),        Effect.provideService(RelayClientTracer, Option.some(productTracer)),      );       expect(spans).toHaveLength(1);      const span = spans[0]!;      expect(span.traceId).toBe("0123456789abcdef0123456789abcdef");      expect(Option.getOrUndefined(span.parent)?.spanId).toBe("0123456789abcdef");    }),  );}); describe("reconcileDesiredCloudLink", () => {  it.effect("requires stored CLI authorization without exposing an HTTP endpoint", () =>    Effect.gen(function* () {      const error = yield* Effect.flip(reconcileDesiredCloudLink("http://127.0.0.1:3774"));       expect(error).toMatchObject({        _tag: "EnvironmentHttpUnauthorizedError",        message: "Run `t3 connect link` to authorize this environment.",      });    }).pipe(      Effect.provideService(        ServerSecretStore.ServerSecretStore,        makeSecretStore(unusedSecretStoreOperation),      ),      Effect.provideService(        ServerEnvironment,        ServerEnvironment.of({          getEnvironmentId: unusedSecretStoreOperation(),          getDescriptor: unusedSecretStoreOperation(),        }),      ),      Effect.provideService(        CloudManagedEndpointRuntime,        CloudManagedEndpointRuntime.of({          applyConfig: unusedSecretStoreOperation,        } satisfies CloudManagedEndpointRuntimeShape),      ),      Effect.provideService(        EnvironmentAuth.EnvironmentAuth,        EnvironmentAuth.EnvironmentAuth.of({} as EnvironmentAuth.EnvironmentAuthShape),      ),      Effect.provideService(        CliTokenManager.CloudCliTokenManager,        CliTokenManager.CloudCliTokenManager.of({          get: unusedSecretStoreOperation(),          getExisting: Effect.succeed(Option.none()),          hasCredential: unusedSecretStoreOperation(),          clear: unusedSecretStoreOperation(),        }),      ),      Effect.provideService(        HttpClient.HttpClient,        HttpClient.make(() => unusedSecretStoreOperation()),      ),      Effect.provide(NodeServices.layer),    ),  );});