import { EnvironmentId } from "@t3tools/contracts";import {  RelayEnvironmentConnectScope,  RelayEnvironmentStatusScope,} from "@t3tools/contracts/relay";import { describe, expect, it } from "@effect/vitest";import * as Duration from "effect/Duration";import * as Effect from "effect/Effect";import * as Fiber from "effect/Fiber";import * as Layer from "effect/Layer";import * as Tracer from "effect/Tracer";import * as Schema from "effect/Schema";import * as TestClock from "effect/testing/TestClock"; import * as ManagedRelay from "./managedRelay.ts";import { remoteHttpClientLayer } from "../rpc/http.ts";import { NETWORK_BLOCKING_HINT } from "../errors/network.ts"; const encodeRelayError = Schema.encodeEffect(ManagedRelay.ManagedRelayClientError);const decodeRelayError = Schema.decodeUnknownEffect(ManagedRelay.ManagedRelayClientError); function managedRelayTestLayer(  fetchFn: typeof globalThis.fetch,  relayUrl = "https://relay.example.test",  accessTokenStore?: ManagedRelay.ManagedRelayAccessTokenStore,) {  const httpClientLayer = remoteHttpClientLayer(fetchFn);  const signerLayer = Layer.succeed(    ManagedRelay.ManagedRelayDpopSigner,    ManagedRelay.ManagedRelayDpopSigner.of({      thumbprint: Effect.succeed("client-thumbprint"),      createProof: (input: ManagedRelay.ManagedRelayDpopProofInput) =>        Effect.succeed(`proof:${input.url}`),    }),  );  return ManagedRelay.layer({    relayUrl,    clientId: "t3-mobile",    ...(accessTokenStore ? { accessTokenStore } : {}),  }).pipe(Layer.provide(signerLayer), Layer.provide(httpClientLayer));} function clerkToken(subject: string, nonce: string): string {  const encode = (value: unknown) =>    btoa(JSON.stringify(value)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");  return `${encode({ alg: "none" })}.${encode({ sub: subject, nonce })}.signature`;} describe("ManagedRelayClient", () => {  it.effect("owns tracing at service and implementation boundaries", () => {    const spanNames: Array<string> = [];    const tracer = Tracer.make({      span: (options) => {        const span = new Tracer.NativeSpan(options);        spanNames.push(span.name);        return span;      },    });    const fetchFn = ((input) => {      const url = String(input);      if (url.endsWith("/v1/client/dpop-token")) {        return Promise.resolve(          Response.json({            access_token: "relay-token",            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 1_800,            scope: RelayEnvironmentStatusScope,          }),        );      }      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-06-05T20:00:00.000Z",          descriptor: {            environmentId: "env-1",            label: "Desktop",            platform: { os: "darwin", arch: "arm64" },            serverVersion: "0.0.0-test",            capabilities: { repositoryIdentity: true },          },        }),      );    }) satisfies typeof globalThis.fetch;     return Effect.gen(function* () {      const relayClient = yield* ManagedRelay.ManagedRelayClient;      yield* relayClient.getEnvironmentStatus({        clerkToken: clerkToken("user-1", "session-1"),        scopes: [RelayEnvironmentStatusScope],        environmentId: EnvironmentId.make("env-1"),      });       expect(spanNames).toEqual(        expect.arrayContaining([          "clientRuntime.managedRelay.getEnvironmentStatus",          "clientRuntime.managedRelay.authorize",          "clientRuntime.managedRelay.obtainAccessToken",          "clientRuntime.managedRelay.tokenCacheCriticalSection",          "clientRuntime.managedRelay.exchangeAccessToken",        ]),      );      expect(spanNames).not.toEqual(        expect.arrayContaining([          "clientRuntime.managedRelay.createTokenExchangeProof",          "clientRuntime.managedRelay.exchangeAccessTokenRequest",          "clientRuntime.managedRelay.createRequestProof",        ]),      );    }).pipe(Effect.withTracer(tracer), Effect.provide(managedRelayTestLayer(fetchFn)));  });   it.effect("rejects unsafe relay URLs before sending credentials", () => {    let requestCount = 0;    const fetchFn = (() => {      requestCount += 1;      return Promise.resolve(Response.json({}));    }) satisfies typeof globalThis.fetch;     return Effect.gen(function* () {      const relayClient = yield* ManagedRelay.ManagedRelayClient;      const error = yield* relayClient        .listEnvironments({ clerkToken: "clerk-token" })        .pipe(Effect.flip);       expect(error).toMatchObject({        _tag: "ManagedRelayUrlInvalidError",        relayUrl: "http://relay.example.test",        message: "Relay URL must be a secure absolute HTTPS origin.",      });      expect(requestCount).toBe(0);    }).pipe(Effect.provide(managedRelayTestLayer(fetchFn, "http://relay.example.test")));  });   it.effect("reuses usable DPoP tokens and refreshes cleared or expiring cache entries", () => {    let tokenExchangeCount = 0;    const fetchFn = ((input) => {      const url = String(input);      if (url.endsWith("/v1/client/dpop-token")) {        tokenExchangeCount += 1;        return Promise.resolve(          Response.json({            access_token: `relay-token-${tokenExchangeCount}`,            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 10,            scope: RelayEnvironmentStatusScope,          }),        );      }      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-05-25T00:01:00.000Z",          descriptor: {            environmentId: "env-1",            label: "Desktop",            platform: { os: "darwin", arch: "arm64" },            serverVersion: "0.0.0-test",            capabilities: { repositoryIdentity: true },          },        }),      );    }) satisfies typeof globalThis.fetch;     return Effect.gen(function* () {      const relayClient = yield* ManagedRelay.ManagedRelayClient;      const statusInput = {        clerkToken: clerkToken("user-1", "session-1"),        scopes: [RelayEnvironmentStatusScope],        environmentId: EnvironmentId.make("env-1"),      } as const;       yield* relayClient.getEnvironmentStatus(statusInput);      yield* relayClient.getEnvironmentStatus(statusInput);      expect(tokenExchangeCount).toBe(1);       yield* TestClock.adjust(Duration.seconds(6));      yield* relayClient.getEnvironmentStatus(statusInput);      expect(tokenExchangeCount).toBe(2);       yield* relayClient.resetTokenCache;      yield* relayClient.getEnvironmentStatus(statusInput);      expect(tokenExchangeCount).toBe(3);    }).pipe(Effect.provide(managedRelayTestLayer(fetchFn)));  });   it.effect("uses a cached token while another scope waits for an exchange", () => {    const exchangeStarted = Promise.withResolvers<void>();    const releaseExchange = Promise.withResolvers<void>();    let tokenExchangeCount = 0;    const statusTokens: Array<string | null> = [];    let persistedTokens: ReadonlyArray<ManagedRelay.ManagedRelayAccessTokenCacheEntry> = [      {        accountId: "user-1",        clientId: "t3-mobile",        relayUrl: "https://relay.example.test",        thumbprint: "client-thumbprint",        scopes: [RelayEnvironmentStatusScope],        accessToken: "cached-status-token",        expiresAtMillis: Number.MAX_SAFE_INTEGER,      },    ];    const accessTokenStore: ManagedRelay.ManagedRelayAccessTokenStore = {      load: Effect.sync(() => persistedTokens),      save: (entries) =>        Effect.sync(() => {          persistedTokens = entries;        }),      clear: Effect.sync(() => {        persistedTokens = [];      }),    };    const fetchFn = ((input, init) => {      if (String(input).endsWith("/v1/client/dpop-token")) {        tokenExchangeCount += 1;        exchangeStarted.resolve();        return releaseExchange.promise.then(() =>          Response.json({            access_token: "expanded-scope-token",            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 1_800,            scope: `${RelayEnvironmentStatusScope} ${RelayEnvironmentConnectScope}`,          }),        );      }      statusTokens.push(new Headers(init?.headers).get("authorization"));      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-09-04T00:00:00.000Z",        }),      );    }) satisfies typeof globalThis.fetch;     return Effect.gen(function* () {      const relayClient = yield* ManagedRelay.ManagedRelayClient;      const statusInput = {        clerkToken: clerkToken("user-1", "session-1"),        scopes: [RelayEnvironmentStatusScope],        environmentId: EnvironmentId.make("env-1"),      } as const;      const expandedScopeInput = {        ...statusInput,        scopes: [RelayEnvironmentStatusScope, RelayEnvironmentConnectScope],      } as const;      const firstMiss = yield* relayClient        .getEnvironmentStatus(expandedScopeInput)        .pipe(Effect.forkChild);      yield* Effect.promise(() => exchangeStarted.promise);      const secondMiss = yield* relayClient        .getEnvironmentStatus(expandedScopeInput)        .pipe(Effect.forkChild);       const status = yield* relayClient.getEnvironmentStatus(statusInput);      expect(status.status).toBe("online");      expect(statusTokens).toEqual(["DPoP cached-status-token"]);       releaseExchange.resolve();      yield* Fiber.join(firstMiss);      yield* Fiber.join(secondMiss);      expect(tokenExchangeCount).toBe(1);      expect(persistedTokens.map((token) => token.accessToken)).toEqual([        "cached-status-token",        "expanded-scope-token",      ]);      yield* relayClient.resetTokenCache;      expect(persistedTokens).toEqual([]);      yield* relayClient.getEnvironmentStatus(expandedScopeInput);      expect(tokenExchangeCount).toBe(2);    }).pipe(      Effect.ensuring(Effect.sync(() => releaseExchange.resolve())),      Effect.provide(managedRelayTestLayer(fetchFn, undefined, accessTokenStore)),    );  });   it.effect("reuses a persisted token across runtimes and Clerk session token rotation", () => {    let tokenExchangeCount = 0;    let persistedTokens: ReadonlyArray<ManagedRelay.ManagedRelayAccessTokenCacheEntry> = [];    const accessTokenStore: ManagedRelay.ManagedRelayAccessTokenStore = {      load: Effect.sync(() => persistedTokens),      save: (entries) =>        Effect.sync(() => {          persistedTokens = entries;        }),      clear: Effect.sync(() => {        persistedTokens = [];      }),    };    const fetchFn = ((input) => {      const url = String(input);      if (url.endsWith("/v1/client/dpop-token")) {        tokenExchangeCount += 1;        return Promise.resolve(          Response.json({            access_token: "persisted-relay-token",            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 1_800,            scope: RelayEnvironmentStatusScope,          }),        );      }      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-06-05T20:00:00.000Z",          descriptor: {            environmentId: "env-1",            label: "Desktop",            platform: { os: "darwin", arch: "arm64" },            serverVersion: "0.0.0-test",            capabilities: { repositoryIdentity: true },          },        }),      );    }) satisfies typeof globalThis.fetch;    const statusInput = (token: string) =>      ({        clerkToken: token,        scopes: [RelayEnvironmentStatusScope],        environmentId: EnvironmentId.make("env-1"),      }) as const;     return Effect.gen(function* () {      yield* Effect.gen(function* () {        const relayClient = yield* ManagedRelay.ManagedRelayClient;        yield* relayClient.getEnvironmentStatus(statusInput(clerkToken("user-1", "session-1")));      }).pipe(Effect.provide(managedRelayTestLayer(fetchFn, undefined, accessTokenStore)));       expect(tokenExchangeCount).toBe(1);      expect(persistedTokens).toHaveLength(1);       yield* Effect.gen(function* () {        const relayClient = yield* ManagedRelay.ManagedRelayClient;        yield* relayClient.getEnvironmentStatus(statusInput(clerkToken("user-1", "session-2")));      }).pipe(Effect.provide(managedRelayTestLayer(fetchFn, undefined, accessTokenStore)));       expect(tokenExchangeCount).toBe(1);    });  });   it.effect("refreshes a persisted DPoP token once when the relay rejects it", () => {    let tokenExchangeCount = 0;    const statusTokens: Array<string | null> = [];    let persistedTokens: ReadonlyArray<ManagedRelay.ManagedRelayAccessTokenCacheEntry> = [      {        accountId: "user-1",        clientId: "t3-mobile",        relayUrl: "https://relay.example.test",        thumbprint: "client-thumbprint",        scopes: [RelayEnvironmentStatusScope],        accessToken: "stale-relay-token",        expiresAtMillis: Number.MAX_SAFE_INTEGER,      },    ];    const accessTokenStore: ManagedRelay.ManagedRelayAccessTokenStore = {      load: Effect.sync(() => persistedTokens),      save: (entries) =>        Effect.sync(() => {          persistedTokens = entries;        }),      clear: Effect.sync(() => {        persistedTokens = [];      }),    };    const fetchFn = ((input, init) => {      const url = String(input);      if (url.endsWith("/v1/client/dpop-token")) {        tokenExchangeCount += 1;        return Promise.resolve(          Response.json({            access_token: "fresh-relay-token",            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 1_800,            scope: RelayEnvironmentStatusScope,          }),        );      }       const authorization = new Headers(init?.headers).get("authorization");      statusTokens.push(authorization);      if (authorization === "DPoP stale-relay-token") {        return Promise.resolve(          Response.json(            {              _tag: "RelayAuthInvalidError",              code: "auth_invalid",              reason: "invalid_bearer",              traceId: "trace-stale-token",            },            { status: 401 },          ),        );      }      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-06-05T20:00:00.000Z",          descriptor: {            environmentId: "env-1",            label: "Desktop",            platform: { os: "darwin", arch: "arm64" },            serverVersion: "0.0.0-test",            capabilities: { repositoryIdentity: true },          },        }),      );    }) satisfies typeof globalThis.fetch;     return Effect.gen(function* () {      const relayClient = yield* ManagedRelay.ManagedRelayClient;      const result = yield* relayClient.getEnvironmentStatus({        clerkToken: clerkToken("user-1", "session-1"),        scopes: [RelayEnvironmentStatusScope],        environmentId: EnvironmentId.make("env-1"),      });       expect(result.status).toBe("online");      expect(statusTokens).toEqual(["DPoP stale-relay-token", "DPoP fresh-relay-token"]);      expect(tokenExchangeCount).toBe(1);      expect(persistedTokens).toMatchObject([        {          accessToken: "fresh-relay-token",        },      ]);    }).pipe(Effect.provide(managedRelayTestLayer(fetchFn, undefined, accessTokenStore)));  });   it.effect("does not persist tokens when the Clerk subject cannot be decoded", () => {    let persistedTokens: ReadonlyArray<ManagedRelay.ManagedRelayAccessTokenCacheEntry> = [];    const accessTokenStore: ManagedRelay.ManagedRelayAccessTokenStore = {      load: Effect.succeed([]),      save: (entries) =>        Effect.sync(() => {          persistedTokens = entries;        }),      clear: Effect.void,    };    const fetchFn = ((input) => {      const url = String(input);      if (url.endsWith("/v1/client/dpop-token")) {        return Promise.resolve(          Response.json({            access_token: "relay-token",            issued_token_type: "urn:ietf:params:oauth:token-type:access_token",            token_type: "DPoP",            expires_in: 1_800,            scope: RelayEnvironmentStatusScope,          }),        );      }      return Promise.resolve(        Response.json({          environmentId: "env-1",          endpoint: {            httpBaseUrl: "https://desktop.example.test/",            wsBaseUrl: "wss://desktop.example.test/ws",            providerKind: "cloudflare_tunnel",          },          status: "online",          checkedAt: "2026-06-05T20:00:00.000Z",          descriptor: {            environmentId: "env-1",            label: "Desktop",            platform: { os: "darwin", arch: "arm64" },            serverVersion: "0.0.0-test",

Lines 1–500 of 708. Load more