import { EnvironmentAuthInvalidError, EnvironmentId } from "@t3tools/contracts";import * as Effect from "effect/Effect";import * as Schema from "effect/Schema";import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test"; const decodeEnvironmentAuthInvalidError = Schema.decodeUnknownSync(EnvironmentAuthInvalidError); let mockSavedRecords: Array<Record<string, unknown>> = []; const mockResolveRemotePairingTarget = vi.fn();const mockFetchRemoteEnvironmentDescriptor = vi.fn();const mockBootstrapRemoteBearerSession = vi.fn();const mockFetchRemoteSessionState = vi.fn();const mockFetchRemoteDpopSessionState = vi.fn();const mockResolveRemoteWebSocketConnectionUrl = vi.fn();let managedRelayDpopSigner: typeof import("@t3tools/client-runtime").ManagedRelayDpopSigner;const mockRemoteHttpRunPromise = vi.fn(<A, E>(effect: Effect.Effect<A, E>) => Effect.runPromise( effect.pipe( Effect.provideService( managedRelayDpopSigner, managedRelayDpopSigner.of({ thumbprint: Effect.succeed("thumbprint"), createProof: () => Effect.succeed("dpop-proof"), }), ), ), ),);const mockBootstrapSshBearerSession = vi.fn();const mockFetchSshSessionState = vi.fn();const mockPersistSavedEnvironmentRecord = vi.fn();const mockWriteSavedEnvironmentBearerToken = vi.fn();const mockWriteSavedEnvironmentCredential = vi.fn();const mockSetSavedEnvironmentRegistry = vi.fn();const mockGetSavedEnvironmentRecord = vi.fn((environmentId: EnvironmentId) => { return mockSavedRecords.find((record) => record.environmentId === environmentId) ?? null;});const mockReadSavedEnvironmentBearerToken = vi.fn();const mockReadSavedEnvironmentCredential = vi.fn();const mockRemoveSavedEnvironmentBearerToken = vi.fn();const mockPatchRuntime = vi.fn();const mockClearRuntime = vi.fn();const mockRegistrySetState = vi.fn((next: { byId: Record<string, Record<string, unknown>> }) => { mockSavedRecords = Object.values(next.byId);});const mockRemove = vi.fn((environmentId: EnvironmentId) => { mockSavedRecords = mockSavedRecords.filter((record) => record.environmentId !== environmentId);});const mockMarkConnected = vi.fn((environmentId: EnvironmentId, connectedAt: string) => { mockSavedRecords = mockSavedRecords.map((record) => record.environmentId === environmentId ? { ...record, lastConnectedAt: connectedAt } : record, );});const mockRename = vi.fn((environmentId: EnvironmentId, label: string) => { mockSavedRecords = mockSavedRecords.map((record) => record.environmentId === environmentId ? { ...record, label } : record, );});const mockUpsert = vi.fn((record: Record<string, unknown>) => { mockSavedRecords = [ ...mockSavedRecords.filter((entry) => entry.environmentId !== record.environmentId), record, ];});const mockListSavedEnvironmentRecords = vi.fn(() => mockSavedRecords);const mockEnsureSshEnvironment = vi.fn();const mockDisconnectSshEnvironment = vi.fn();const mockFetchSshEnvironmentDescriptor = vi.fn();const mockToPersistedSavedEnvironmentRecord = vi.fn((record) => record);const mockCreateEnvironmentConnection = vi.fn();const mockClientGetConfig = vi.fn(async () => ({ environment: { environmentId: EnvironmentId.make("environment-1"), label: "Remote environment", },}));const mockConnectManagedCloudEnvironment = vi.fn();const mockReadManagedRelayClerkToken = vi.fn(); vi.mock("@t3tools/shared/remote", async (importOriginal) => ({ ...(await importOriginal<typeof import("@t3tools/shared/remote")>()), resolveRemotePairingTarget: mockResolveRemotePairingTarget,})); vi.mock("../../lib/runtime", () => ({ webRuntime: { runPromise: mockRemoteHttpRunPromise, },})); vi.mock("../../cloud/linkEnvironment", () => ({ connectManagedCloudEnvironment: mockConnectManagedCloudEnvironment,})); vi.mock("../../cloud/managedAuth", () => ({ readManagedRelayClerkToken: mockReadManagedRelayClerkToken,})); vi.mock("~/localApi", () => ({ ensureLocalApi: () => ({ persistence: { setSavedEnvironmentRegistry: mockSetSavedEnvironmentRegistry, }, }),})); vi.mock("./catalog", () => ({ getSavedEnvironmentRecord: mockGetSavedEnvironmentRecord, hasSavedEnvironmentRegistryHydrated: vi.fn(), listSavedEnvironmentRecords: mockListSavedEnvironmentRecords, persistSavedEnvironmentRecord: mockPersistSavedEnvironmentRecord, readSavedEnvironmentBearerToken: mockReadSavedEnvironmentBearerToken, readSavedEnvironmentCredential: mockReadSavedEnvironmentCredential, removeSavedEnvironmentBearerToken: mockRemoveSavedEnvironmentBearerToken, toPersistedSavedEnvironmentRecord: mockToPersistedSavedEnvironmentRecord, useSavedEnvironmentRegistryStore: { getState: () => ({ upsert: mockUpsert, remove: mockRemove, markConnected: mockMarkConnected, rename: mockRename, }), setState: mockRegistrySetState, subscribe: vi.fn(() => () => {}), }, useSavedEnvironmentRuntimeStore: { getState: () => ({ ensure: vi.fn(), patch: mockPatchRuntime, clear: mockClearRuntime, }), }, waitForSavedEnvironmentRegistryHydration: vi.fn(), writeSavedEnvironmentBearerToken: mockWriteSavedEnvironmentBearerToken, writeSavedEnvironmentCredential: mockWriteSavedEnvironmentCredential,})); vi.mock("./connection", async (importOriginal) => ({ ...(await importOriginal<typeof import("./connection")>()), createEnvironmentConnection: mockCreateEnvironmentConnection,})); vi.mock("@t3tools/client-runtime", async (importOriginal) => { const actual = await importOriginal<typeof import("@t3tools/client-runtime")>(); managedRelayDpopSigner = actual.ManagedRelayDpopSigner; return { ...actual, bootstrapRemoteBearerSession: mockBootstrapRemoteBearerSession, createWsRpcClient: vi.fn(() => ({ server: { getConfig: mockClientGetConfig, }, terminal: { onMetadata: vi.fn(() => () => undefined), }, orchestration: { subscribeThread: vi.fn(() => () => {}), }, })), fetchRemoteEnvironmentDescriptor: mockFetchRemoteEnvironmentDescriptor, fetchRemoteSessionState: mockFetchRemoteSessionState, fetchRemoteDpopSessionState: mockFetchRemoteDpopSessionState, resolveRemoteWebSocketConnectionUrl: mockResolveRemoteWebSocketConnectionUrl, };}); vi.mock("../../rpc/wsTransport", () => ({ WsTransport: vi.fn(),})); describe("addSavedEnvironment", () => { afterEach(() => { vi.useRealTimers(); }); beforeEach(() => { vi.resetModules(); vi.clearAllMocks(); mockSavedRecords = []; vi.stubGlobal("window", { desktopBridge: { ensureSshEnvironment: mockEnsureSshEnvironment, disconnectSshEnvironment: mockDisconnectSshEnvironment, fetchSshEnvironmentDescriptor: mockFetchSshEnvironmentDescriptor, bootstrapSshBearerSession: mockBootstrapSshBearerSession, fetchSshSessionState: mockFetchSshSessionState, issueSshWebSocketTicket: vi.fn(), }, }); mockResolveRemotePairingTarget.mockImplementation( (input: { host?: string; pairingCode?: string }) => ({ httpBaseUrl: input.host ? input.host.endsWith("/") ? input.host : `${input.host}/` : "https://remote.example.com/", wsBaseUrl: input.host ? input.host.replace(/^http/u, "ws").endsWith("/") ? input.host.replace(/^http/u, "ws") : `${input.host.replace(/^http/u, "ws")}/` : "wss://remote.example.com/", credential: input.pairingCode ?? "pairing-code", }), ); mockReadSavedEnvironmentCredential.mockImplementation(async () => { const token = await mockReadSavedEnvironmentBearerToken(); return token ? { version: 1, method: "bearer", token } : null; }); mockFetchRemoteEnvironmentDescriptor.mockReturnValue( Effect.succeed({ environmentId: EnvironmentId.make("environment-1"), label: "Remote environment", }), ); mockBootstrapRemoteBearerSession.mockReturnValue( Effect.succeed({ access_token: "bearer-token", scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read", }), ); mockFetchRemoteSessionState.mockReturnValue( Effect.succeed({ authenticated: true, scopes: ["orchestration:read", "access:write"], }), ); mockFetchRemoteDpopSessionState.mockReturnValue( Effect.succeed({ authenticated: true, scopes: ["orchestration:read", "access:write"], }), ); mockResolveRemoteWebSocketConnectionUrl.mockReturnValue( Effect.succeed("wss://remote.example.com/?wsTicket=remote-token"), ); mockFetchSshEnvironmentDescriptor.mockResolvedValue({ environmentId: EnvironmentId.make("environment-1"), label: "Remote environment", }); mockBootstrapSshBearerSession.mockResolvedValue({ access_token: "ssh-bearer-token", scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read", }); mockPersistSavedEnvironmentRecord.mockResolvedValue(undefined); mockWriteSavedEnvironmentBearerToken.mockResolvedValue(false); mockWriteSavedEnvironmentCredential.mockResolvedValue(true); mockReadManagedRelayClerkToken.mockResolvedValue(null); mockSetSavedEnvironmentRegistry.mockResolvedValue(undefined); mockReadSavedEnvironmentBearerToken.mockResolvedValue(null); mockRemoveSavedEnvironmentBearerToken.mockResolvedValue(undefined); mockFetchSshSessionState.mockResolvedValue({ authenticated: true, scopes: ["orchestration:read", "access:write"], }); mockCreateEnvironmentConnection.mockImplementation( (input: { knownEnvironment: { environmentId: EnvironmentId }; client: unknown }) => ({ kind: "saved", environmentId: input.knownEnvironment.environmentId, knownEnvironment: input.knownEnvironment, client: input.client, ensureBootstrapped: async () => undefined, reconnect: async () => undefined, dispose: async () => undefined, }), ); mockClientGetConfig.mockResolvedValue({ environment: { environmentId: EnvironmentId.make("environment-1"), label: "Remote environment", }, }); mockEnsureSshEnvironment.mockResolvedValue({ target: { alias: "devbox", hostname: "devbox.example.com", username: "julius", port: 22, }, httpBaseUrl: "http://127.0.0.1:3774/", wsBaseUrl: "ws://127.0.0.1:3774/", pairingToken: "ssh-pairing-code", }); mockDisconnectSshEnvironment.mockResolvedValue(undefined); }); it("rolls back persisted metadata when bearer token persistence fails", async () => { const { addSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await expect( addSavedEnvironment({ label: "Remote environment", host: "remote.example.com", pairingCode: "123456", }), ).rejects.toThrow("Unable to persist saved environment credentials."); expect(mockPersistSavedEnvironmentRecord).toHaveBeenCalledTimes(1); expect(mockWriteSavedEnvironmentBearerToken).toHaveBeenCalledWith( EnvironmentId.make("environment-1"), "bearer-token", ); expect(mockSetSavedEnvironmentRegistry).toHaveBeenCalledWith([]); expect(mockUpsert).not.toHaveBeenCalled(); await resetEnvironmentServiceForTests(); }); it("restores unrelated saved environments when credential persistence rollback runs", async () => { mockSavedRecords = [ { environmentId: EnvironmentId.make("environment-existing"), label: "Existing environment", httpBaseUrl: "https://existing.example.com/", wsBaseUrl: "wss://existing.example.com/", createdAt: "2026-04-14T00:00:00.000Z", lastConnectedAt: null, }, ]; const { addSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await expect( addSavedEnvironment({ label: "Remote environment", host: "remote.example.com", pairingCode: "123456", }), ).rejects.toThrow("Unable to persist saved environment credentials."); expect(mockSetSavedEnvironmentRegistry).toHaveBeenCalledWith([ expect.objectContaining({ environmentId: EnvironmentId.make("environment-existing"), }), ]); await resetEnvironmentServiceForTests(); }); it("persists the server label after saved environment metadata refresh", async () => { mockWriteSavedEnvironmentBearerToken.mockResolvedValue(true); mockClientGetConfig.mockResolvedValue({ environment: { environmentId: EnvironmentId.make("environment-1"), label: "Julius's Mac mini", }, }); const { addSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await expect( addSavedEnvironment({ label: "100.65.180.100", host: "remote.example.com", pairingCode: "123456", }), ).resolves.toMatchObject({ environmentId: EnvironmentId.make("environment-1"), }); expect(mockRename).toHaveBeenCalledWith( EnvironmentId.make("environment-1"), "Julius's Mac mini", ); expect(mockSavedRecords).toEqual([ expect.objectContaining({ environmentId: EnvironmentId.make("environment-1"), label: "Julius's Mac mini", }), ]); await resetEnvironmentServiceForTests(); }); it("installs relay-managed environments with versioned DPoP credentials", async () => { const { addManagedRelayEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await addManagedRelayEnvironment({ environmentId: EnvironmentId.make("environment-1"), label: "Managed remote", httpBaseUrl: "https://managed.example.com/", wsBaseUrl: "wss://managed.example.com/", relayUrl: "https://relay.example.com", accessToken: "managed-access-token", }); expect(mockWriteSavedEnvironmentCredential).toHaveBeenCalledWith( EnvironmentId.make("environment-1"), { version: 1, method: "dpop", accessToken: "managed-access-token", }, ); expect(mockFetchRemoteDpopSessionState).toHaveBeenCalledWith({ httpBaseUrl: "https://managed.example.com/", accessToken: "managed-access-token", dpopProof: "dpop-proof", }); await resetEnvironmentServiceForTests(); }); it("renews expired managed DPoP credentials through the relay", async () => { const environmentId = EnvironmentId.make("environment-1"); mockSavedRecords = [ { environmentId, label: "Managed remote", httpBaseUrl: "https://managed.example.com/", wsBaseUrl: "wss://managed.example.com/", createdAt: "2026-05-25T00:00:00.000Z", lastConnectedAt: null, relayManaged: { relayUrl: "https://relay.example.com" }, }, ]; mockReadSavedEnvironmentCredential.mockResolvedValue({ version: 1, method: "dpop", accessToken: "expired-access-token", }); mockFetchRemoteDpopSessionState .mockReturnValueOnce( Effect.fail( decodeEnvironmentAuthInvalidError({ _tag: "EnvironmentAuthInvalidError", code: "auth_invalid", reason: "invalid_credential", traceId: "trace-auth-expired", }), ), ) .mockReturnValue(Effect.succeed({ authenticated: true, scopes: ["orchestration:read"] })); mockReadManagedRelayClerkToken.mockResolvedValue("clerk-token"); mockConnectManagedCloudEnvironment.mockReturnValue( Effect.succeed({ environmentId, label: "Managed remote", httpBaseUrl: "https://managed.example.com/", wsBaseUrl: "wss://managed.example.com/", relayUrl: "https://relay.example.com", accessToken: "renewed-access-token", }), ); const { reconnectSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await reconnectSavedEnvironment(environmentId); expect(mockConnectManagedCloudEnvironment).toHaveBeenCalledWith({ clerkToken: "clerk-token", relayUrl: "https://relay.example.com", environment: expect.objectContaining({ environmentId }), }); expect(mockWriteSavedEnvironmentCredential).toHaveBeenCalledWith(environmentId, { version: 1, method: "dpop", accessToken: "renewed-access-token", }); await resetEnvironmentServiceForTests(); }); it("removes an older ssh record when the same target returns a new environment id", async () => { mockWriteSavedEnvironmentBearerToken.mockResolvedValue(true); mockFetchSshEnvironmentDescriptor.mockResolvedValue({ environmentId: EnvironmentId.make("environment-2"), label: "Remote environment", }); mockSavedRecords = [ { environmentId: EnvironmentId.make("environment-1"), label: "Old ssh environment", httpBaseUrl: "http://127.0.0.1:3774/", wsBaseUrl: "ws://127.0.0.1:3774/", createdAt: "2026-04-14T00:00:00.000Z", lastConnectedAt: null, desktopSsh: { alias: "devbox", hostname: "devbox.example.com", username: "julius", port: 22, }, }, ]; const { addSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await expect( addSavedEnvironment({ label: "Remote environment", host: "http://127.0.0.1:3774/", pairingCode: "ssh-pairing-code", desktopSsh: { alias: "devbox", hostname: "devbox.example.com", username: "julius", port: 22, }, }), ).resolves.toMatchObject({Lines 1–500 of 1062. Load more
import { EnvironmentAuthInvalidError, EnvironmentId } from "@t3tools/contracts"; import * as Effect from "effect/Effect"; import * as Schema from "effect/Schema"; import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test"; const decodeEnvironmentAuthInvalidError = Schema.decodeUnknownSync(EnvironmentAuthInvalidError); let mockSavedRecords: Array<Record<string, unknown>> = []; const mockResolveRemotePairingTarget = vi.fn(); const mockFetchRemoteEnvironmentDescriptor = vi.fn(); const mockBootstrapRemoteBearerSession = vi.fn(); const mockFetchRemoteSessionState = vi.fn(); const mockFetchRemoteDpopSessionState = vi.fn(); const mockResolveRemoteWebSocketConnectionUrl = vi.fn(); let managedRelayDpopSigner: typeof import("@t3tools/client-runtime").ManagedRelayDpopSigner; const mockRemoteHttpRunPromise = vi.fn(<A, E>(effect: Effect.Effect<A, E>) => Effect.runPromise( effect.pipe( Effect.provideService( managedRelayDpopSigner, managedRelayDpopSigner.of({ thumbprint: Effect.succeed("thumbprint"), createProof: () => Effect.succeed("dpop-proof"), }), ), ), ), ); const mockBootstrapSshBearerSession = vi.fn(); const mockFetchSshSessionState = vi.fn(); const mockPersistSavedEnvironmentRecord = vi.fn(); const mockWriteSavedEnvironmentBearerToken = vi.fn(); const mockWriteSavedEnvironmentCredential = vi.fn(); const mockSetSavedEnvironmentRegistry = vi.fn(); const mockGetSavedEnvironmentRecord = vi.fn((environmentId: EnvironmentId) => { return mockSavedRecords.find((record) => record.environmentId === environmentId) ?? null; }); const mockReadSavedEnvironmentBearerToken = vi.fn(); const mockReadSavedEnvironmentCredential = vi.fn(); const mockRemoveSavedEnvironmentBearerToken = vi.fn(); const mockPatchRuntime = vi.fn(); const mockClearRuntime = vi.fn(); const mockRegistrySetState = vi.fn((next: { byId: Record<string, Record<string, unknown>> }) => { mockSavedRecords = Object.values(next.byId); }); const mockRemove = vi.fn((environmentId: EnvironmentId) => { mockSavedRecords = mockSavedRecords.filter((record) => record.environmentId !== environmentId); }); const mockMarkConnected = vi.fn((environmentId: EnvironmentId, connectedAt: string) => { mockSavedRecords = mockSavedRecords.map((record) => record.environmentId === environmentId ? { ...record, lastConnectedAt: connectedAt } : record, ); }); const mockRename = vi.fn((environmentId: EnvironmentId, label: string) => { mockSavedRecords = mockSavedRecords.map((record) => record.environmentId === environmentId ? { ...record, label } : record, ); }); const mockUpsert = vi.fn((record: Record<string, unknown>) => { mockSavedRecords = [ ...mockSavedRecords.filter((entry) => entry.environmentId !== record.environmentId), record, ]; }); const mockListSavedEnvironmentRecords = vi.fn(() => mockSavedRecords); const mockEnsureSshEnvironment = vi.fn(); const mockDisconnectSshEnvironment = vi.fn(); const mockFetchSshEnvironmentDescriptor = vi.fn(); const mockToPersistedSavedEnvironmentRecord = vi.fn((record) => record); const mockCreateEnvironmentConnection = vi.fn(); const mockClientGetConfig = vi.fn(async () => ({ environment: { environmentId: EnvironmentId.make("environment-1"), label: "Remote environment", }, })); const mockConnectManagedCloudEnvironment = vi.fn(); const mockReadManagedRelayClerkToken = vi.fn(); vi.mock("@t3tools/shared/remote", async (importOriginal) => ({ ...(await importOriginal<typeof import("@t3tools/shared/remote")>()), resolveRemotePairingTarget: mockResolveRemotePairingTarget, })); vi.mock("../../lib/runtime", () => ({ webRuntime: { runPromise: mockRemoteHttpRunPromise, }, })); vi.mock("../../cloud/linkEnvironment", () => ({ connectManagedCloudEnvironment: mockConnectManagedCloudEnvironment, })); vi.mock("../../cloud/managedAuth", () => ({ readManagedRelayClerkToken: mockReadManagedRelayClerkToken, })); vi.mock("~/localApi", () => ({ ensureLocalApi: () => ({ persistence: { setSavedEnvironmentRegistry: mockSetSavedEnvironmentRegistry, }, }), })); vi.mock("./catalog", () => ({ getSavedEnvironmentRecord: mockGetSavedEnvironmentRecord, hasSavedEnvironmentRegistryHydrated: vi.fn(), listSavedEnvironmentRecords: mockListSavedEnvironmentRecords, persistSavedEnvironmentRecord: mockPersistSavedEnvironmentRecord, readSavedEnvironmentBearerToken: mockReadSavedEnvironmentBearerToken, readSavedEnvironmentCredential: mockReadSavedEnvironmentCredential, removeSavedEnvironmentBearerToken: mockRemoveSavedEnvironmentBearerToken, toPersistedSavedEnvironmentRecord: mockToPersistedSavedEnvironmentRecord, useSavedEnvironmentRegistryStore: { getState: () => ({ upsert: mockUpsert, remove: mockRemove, markConnected: mockMarkConnected, rename: mockRename, }), setState: mockRegistrySetState, subscribe: vi.fn(() => () => {}), }, useSavedEnvironmentRuntimeStore: { getState: () => ({ ensure: vi.fn(), patch: mockPatchRuntime, clear: mockClearRuntime, }), }, waitForSavedEnvironmentRegistryHydration: vi.fn(), writeSavedEnvironmentBearerToken: mockWriteSavedEnvironmentBearerToken, writeSavedEnvironmentCredential: mockWriteSavedEnvironmentCredential, })); vi.mock("./connection", async (importOriginal) => ({ ...(await importOriginal<typeof import("./connection")>()), createEnvironmentConnection: mockCreateEnvironmentConnection, })); vi.mock("@t3tools/client-runtime", async (importOriginal) => { const actual = await importOriginal<typeof import("@t3tools/client-runtime")>(); managedRelayDpopSigner = actual.ManagedRelayDpopSigner; return { ...actual, bootstrapRemoteBearerSession: mockBootstrapRemoteBearerSession, createWsRpcClient: vi.fn(() => ({ server: { getConfig: mockClientGetConfig, }, terminal: { onMetadata: vi.fn(() => () => undefined), }, orchestration: { subscribeThread: vi.fn(() => () => {}), }, })), fetchRemoteEnvironmentDescriptor: mockFetchRemoteEnvironmentDescriptor, fetchRemoteSessionState: mockFetchRemoteSessionState, fetchRemoteDpopSessionState: mockFetchRemoteDpopSessionState, resolveRemoteWebSocketConnectionUrl: mockResolveRemoteWebSocketConnectionUrl, }; }); vi.mock("../../rpc/wsTransport", () => ({ WsTransport: vi.fn(), })); describe("addSavedEnvironment", () => { afterEach(() => { vi.useRealTimers(); }); beforeEach(() => { vi.resetModules(); vi.clearAllMocks(); mockSavedRecords = []; vi.stubGlobal("window", { desktopBridge: { ensureSshEnvironment: mockEnsureSshEnvironment, disconnectSshEnvironment: mockDisconnectSshEnvironment, fetchSshEnvironmentDescriptor: mockFetchSshEnvironmentDescriptor, bootstrapSshBearerSession: mockBootstrapSshBearerSession, fetchSshSessionState: mockFetchSshSessionState, issueSshWebSocketTicket: vi.fn(), }, }); mockResolveRemotePairingTarget.mockImplementation( (input: { host?: string; pairingCode?: string }) => ({ httpBaseUrl: input.host ? input.host.endsWith("/") ? input.host : `${input.host}/` : "https://remote.example.com/", wsBaseUrl: input.host ? input.host.replace(/^http/u, "ws").endsWith("/") ? input.host.replace(/^http/u, "ws") : `${input.host.replace(/^http/u, "ws")}/` : "wss://remote.example.com/", credential: input.pairingCode ?? "pairing-code", }), ); mockReadSavedEnvironmentCredential.mockImplementation(async () => { const token = await mockReadSavedEnvironmentBearerToken(); return token ? { version: 1, method: "bearer", token } : null; }); mockFetchRemoteEnvironmentDescriptor.mockReturnValue( Effect.succeed({ environmentId: EnvironmentId.make("environment-1"), label: "Remote environment", }), ); mockBootstrapRemoteBearerSession.mockReturnValue( Effect.succeed({ access_token: "bearer-token", scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read", }), ); mockFetchRemoteSessionState.mockReturnValue( Effect.succeed({ authenticated: true, scopes: ["orchestration:read", "access:write"], }), ); mockFetchRemoteDpopSessionState.mockReturnValue( Effect.succeed({ authenticated: true, scopes: ["orchestration:read", "access:write"], }), ); mockResolveRemoteWebSocketConnectionUrl.mockReturnValue( Effect.succeed("wss://remote.example.com/?wsTicket=remote-token"), ); mockFetchSshEnvironmentDescriptor.mockResolvedValue({ environmentId: EnvironmentId.make("environment-1"), label: "Remote environment", }); mockBootstrapSshBearerSession.mockResolvedValue({ access_token: "ssh-bearer-token", scope: "orchestration:read orchestration:operate terminal:operate review:write relay:read", }); mockPersistSavedEnvironmentRecord.mockResolvedValue(undefined); mockWriteSavedEnvironmentBearerToken.mockResolvedValue(false); mockWriteSavedEnvironmentCredential.mockResolvedValue(true); mockReadManagedRelayClerkToken.mockResolvedValue(null); mockSetSavedEnvironmentRegistry.mockResolvedValue(undefined); mockReadSavedEnvironmentBearerToken.mockResolvedValue(null); mockRemoveSavedEnvironmentBearerToken.mockResolvedValue(undefined); mockFetchSshSessionState.mockResolvedValue({ authenticated: true, scopes: ["orchestration:read", "access:write"], }); mockCreateEnvironmentConnection.mockImplementation( (input: { knownEnvironment: { environmentId: EnvironmentId }; client: unknown }) => ({ kind: "saved", environmentId: input.knownEnvironment.environmentId, knownEnvironment: input.knownEnvironment, client: input.client, ensureBootstrapped: async () => undefined, reconnect: async () => undefined, dispose: async () => undefined, }), ); mockClientGetConfig.mockResolvedValue({ environment: { environmentId: EnvironmentId.make("environment-1"), label: "Remote environment", }, }); mockEnsureSshEnvironment.mockResolvedValue({ target: { alias: "devbox", hostname: "devbox.example.com", username: "julius", port: 22, }, httpBaseUrl: "http://127.0.0.1:3774/", wsBaseUrl: "ws://127.0.0.1:3774/", pairingToken: "ssh-pairing-code", }); mockDisconnectSshEnvironment.mockResolvedValue(undefined); }); it("rolls back persisted metadata when bearer token persistence fails", async () => { const { addSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await expect( addSavedEnvironment({ label: "Remote environment", host: "remote.example.com", pairingCode: "123456", }), ).rejects.toThrow("Unable to persist saved environment credentials."); expect(mockPersistSavedEnvironmentRecord).toHaveBeenCalledTimes(1); expect(mockWriteSavedEnvironmentBearerToken).toHaveBeenCalledWith( EnvironmentId.make("environment-1"), "bearer-token", ); expect(mockSetSavedEnvironmentRegistry).toHaveBeenCalledWith([]); expect(mockUpsert).not.toHaveBeenCalled(); await resetEnvironmentServiceForTests(); }); it("restores unrelated saved environments when credential persistence rollback runs", async () => { mockSavedRecords = [ { environmentId: EnvironmentId.make("environment-existing"), label: "Existing environment", httpBaseUrl: "https://existing.example.com/", wsBaseUrl: "wss://existing.example.com/", createdAt: "2026-04-14T00:00:00.000Z", lastConnectedAt: null, }, ]; const { addSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await expect( addSavedEnvironment({ label: "Remote environment", host: "remote.example.com", pairingCode: "123456", }), ).rejects.toThrow("Unable to persist saved environment credentials."); expect(mockSetSavedEnvironmentRegistry).toHaveBeenCalledWith([ expect.objectContaining({ environmentId: EnvironmentId.make("environment-existing"), }), ]); await resetEnvironmentServiceForTests(); }); it("persists the server label after saved environment metadata refresh", async () => { mockWriteSavedEnvironmentBearerToken.mockResolvedValue(true); mockClientGetConfig.mockResolvedValue({ environment: { environmentId: EnvironmentId.make("environment-1"), label: "Julius's Mac mini", }, }); const { addSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await expect( addSavedEnvironment({ label: "100.65.180.100", host: "remote.example.com", pairingCode: "123456", }), ).resolves.toMatchObject({ environmentId: EnvironmentId.make("environment-1"), }); expect(mockRename).toHaveBeenCalledWith( EnvironmentId.make("environment-1"), "Julius's Mac mini", ); expect(mockSavedRecords).toEqual([ expect.objectContaining({ environmentId: EnvironmentId.make("environment-1"), label: "Julius's Mac mini", }), ]); await resetEnvironmentServiceForTests(); }); it("installs relay-managed environments with versioned DPoP credentials", async () => { const { addManagedRelayEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await addManagedRelayEnvironment({ environmentId: EnvironmentId.make("environment-1"), label: "Managed remote", httpBaseUrl: "https://managed.example.com/", wsBaseUrl: "wss://managed.example.com/", relayUrl: "https://relay.example.com", accessToken: "managed-access-token", }); expect(mockWriteSavedEnvironmentCredential).toHaveBeenCalledWith( EnvironmentId.make("environment-1"), { version: 1, method: "dpop", accessToken: "managed-access-token", }, ); expect(mockFetchRemoteDpopSessionState).toHaveBeenCalledWith({ httpBaseUrl: "https://managed.example.com/", accessToken: "managed-access-token", dpopProof: "dpop-proof", }); await resetEnvironmentServiceForTests(); }); it("renews expired managed DPoP credentials through the relay", async () => { const environmentId = EnvironmentId.make("environment-1"); mockSavedRecords = [ { environmentId, label: "Managed remote", httpBaseUrl: "https://managed.example.com/", wsBaseUrl: "wss://managed.example.com/", createdAt: "2026-05-25T00:00:00.000Z", lastConnectedAt: null, relayManaged: { relayUrl: "https://relay.example.com" }, }, ]; mockReadSavedEnvironmentCredential.mockResolvedValue({ version: 1, method: "dpop", accessToken: "expired-access-token", }); mockFetchRemoteDpopSessionState .mockReturnValueOnce( Effect.fail( decodeEnvironmentAuthInvalidError({ _tag: "EnvironmentAuthInvalidError", code: "auth_invalid", reason: "invalid_credential", traceId: "trace-auth-expired", }), ), ) .mockReturnValue(Effect.succeed({ authenticated: true, scopes: ["orchestration:read"] })); mockReadManagedRelayClerkToken.mockResolvedValue("clerk-token"); mockConnectManagedCloudEnvironment.mockReturnValue( Effect.succeed({ environmentId, label: "Managed remote", httpBaseUrl: "https://managed.example.com/", wsBaseUrl: "wss://managed.example.com/", relayUrl: "https://relay.example.com", accessToken: "renewed-access-token", }), ); const { reconnectSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await reconnectSavedEnvironment(environmentId); expect(mockConnectManagedCloudEnvironment).toHaveBeenCalledWith({ clerkToken: "clerk-token", relayUrl: "https://relay.example.com", environment: expect.objectContaining({ environmentId }), }); expect(mockWriteSavedEnvironmentCredential).toHaveBeenCalledWith(environmentId, { version: 1, method: "dpop", accessToken: "renewed-access-token", }); await resetEnvironmentServiceForTests(); }); it("removes an older ssh record when the same target returns a new environment id", async () => { mockWriteSavedEnvironmentBearerToken.mockResolvedValue(true); mockFetchSshEnvironmentDescriptor.mockResolvedValue({ environmentId: EnvironmentId.make("environment-2"), label: "Remote environment", }); mockSavedRecords = [ { environmentId: EnvironmentId.make("environment-1"), label: "Old ssh environment", httpBaseUrl: "http://127.0.0.1:3774/", wsBaseUrl: "ws://127.0.0.1:3774/", createdAt: "2026-04-14T00:00:00.000Z", lastConnectedAt: null, desktopSsh: { alias: "devbox", hostname: "devbox.example.com", username: "julius", port: 22, }, }, ]; const { addSavedEnvironment, resetEnvironmentServiceForTests } = await import("./service"); await expect( addSavedEnvironment({ label: "Remote environment", host: "http://127.0.0.1:3774/", pairingCode: "ssh-pairing-code", desktopSsh: { alias: "devbox", hostname: "devbox.example.com", username: "julius", port: 22, }, }), ).resolves.toMatchObject({