openAgent

1import { expect } from "bun:test"
2import { LayerNode } from "@opencode-ai/core/effect/layer-node"
3import { httpClient } from "@opencode-ai/core/effect/app-node-platform"
4import { Duration, Effect, Layer, Option, Schema } from "effect"
5import { sql } from "drizzle-orm"
6import { HttpClient, HttpClientError, HttpClientResponse } from "effect/unstable/http"
7 
8import { AccountRepo } from "../../src/account/repo"
9import { Account } from "../../src/account/account"
10import {
11  AccessToken,
12  AccountID,
13  AccountTransportError,
14  DeviceCode,
15  Login,
16  Org,
17  OrgID,
18  RefreshToken,
19  UserCode,
20} from "../../src/account/schema"
21import { Database } from "@opencode-ai/core/database/database"
22import { testEffect } from "../lib/effect"
23 
24const truncate = Layer.effectDiscard(
25  Effect.gen(function* () {
26    const { db } = yield* Database.Service
27    yield* db.run(sql`DELETE FROM account_state`)
28    yield* db.run(sql`DELETE FROM account`)
29  }),
30)
31const truncateNode = LayerNode.make({ name: "truncate-account", layer: truncate, deps: [Database.node] })
32 
33const it = testEffect(LayerNode.compile(LayerNode.group([AccountRepo.node, truncateNode])))
34 
35const insideEagerRefreshWindow = Duration.toMillis(Duration.minutes(1))
36const outsideEagerRefreshWindow = Duration.toMillis(Duration.minutes(10))
37 
38const live = (client: HttpClient.HttpClient) =>
39  LayerNode.compile(Account.node, [[httpClient, Layer.succeed(HttpClient.HttpClient, client)]])
40 
41const json = (req: Parameters<typeof HttpClientResponse.fromWeb>[0], body: unknown, status = 200) =>
42  HttpClientResponse.fromWeb(
43    req,
44    new Response(JSON.stringify(body), {
45      status,
46      headers: { "content-type": "application/json" },
47    }),
48  )
49 
50const encodeOrg = Schema.encodeSync(Org)
51 
52const org = (id: string, name: string) => encodeOrg(new Org({ id: OrgID.make(id), name }))
53 
54const login = () =>
55  new Login({
56    code: DeviceCode.make("device-code"),
57    user: UserCode.make("user-code"),
58    url: "https://one.example.com/verify",
59    server: "https://one.example.com",
60    expiry: Duration.seconds(600),
61    interval: Duration.seconds(5),
62  })
63 
64const deviceTokenClient = (body: unknown, status = 400) =>
65  HttpClient.make((req) =>
66    Effect.succeed(
67      req.url === "https://one.example.com/auth/device/token" ? json(req, body, status) : json(req, {}, 404),
68    ),
69  )
70 
71const poll = (body: unknown, status = 400) =>
72  Account.Service.use((s) => s.poll(login())).pipe(Effect.provide(live(deviceTokenClient(body, status))))
73 
74it.live("login normalizes trailing slashes in the provided server URL", () =>
75  Effect.gen(function* () {
76    const seen: Array<string> = []
77    const client = HttpClient.make((req) =>
78      Effect.gen(function* () {
79        seen.push(`${req.method} ${req.url}`)
80 
81        if (req.url === "https://one.example.com/auth/device/code") {
82          return json(req, {
83            device_code: "device-code",
84            user_code: "user-code",
85            verification_uri_complete: "/device?user_code=user-code",
86            expires_in: 600,
87            interval: 5,
88          })
89        }
90 
91        return json(req, {}, 404)
92      }),
93    )
94 
95    const result = yield* Account.use.login("https://one.example.com/").pipe(Effect.provide(live(client)))
96 
97    expect(seen).toEqual(["POST https://one.example.com/auth/device/code"])
98    expect(result.server).toBe("https://one.example.com")
99    expect(result.url).toBe("https://one.example.com/device?user_code=user-code")
100  }),
101)
102 
103it.live("login maps transport failures to account transport errors", () =>
104  Effect.gen(function* () {
105    const client = HttpClient.make((req) =>
106      Effect.fail(
107        new HttpClientError.HttpClientError({
108          reason: new HttpClientError.TransportError({ request: req }),
109        }),
110      ),
111    )
112 
113    const error = yield* Effect.flip(Account.use.login("https://one.example.com").pipe(Effect.provide(live(client))))
114 
115    expect(error).toBeInstanceOf(AccountTransportError)
116    if (error instanceof AccountTransportError) {
117      expect(error.method).toBe("POST")
118      expect(error.url).toBe("https://one.example.com/auth/device/code")
119    }
120  }),
121)
122 
123it.live("orgsByAccount groups orgs per account", () =>
124  Effect.gen(function* () {
125    yield* AccountRepo.Service.use((r) =>
126      r.persistAccount({
127        id: AccountID.make("user-1"),
128        email: "one@example.com",
129        url: "https://one.example.com",
130        accessToken: AccessToken.make("at_1"),
131        refreshToken: RefreshToken.make("rt_1"),
132        expiry: Date.now() + outsideEagerRefreshWindow,
133        orgID: Option.none(),
134      }),
135    )
136 
137    yield* AccountRepo.Service.use((r) =>
138      r.persistAccount({
139        id: AccountID.make("user-2"),
140        email: "two@example.com",
141        url: "https://two.example.com",
142        accessToken: AccessToken.make("at_2"),
143        refreshToken: RefreshToken.make("rt_2"),
144        expiry: Date.now() + outsideEagerRefreshWindow,
145        orgID: Option.none(),
146      }),
147    )
148 
149    const seen: Array<string> = []
150    const client = HttpClient.make((req) =>
151      Effect.gen(function* () {
152        seen.push(`${req.method} ${req.url}`)
153 
154        if (req.url === "https://one.example.com/api/orgs") {
155          return json(req, [org("org-1", "One")])
156        }
157 
158        if (req.url === "https://two.example.com/api/orgs") {
159          return json(req, [org("org-2", "Two A"), org("org-3", "Two B")])
160        }
161 
162        return json(req, [], 404)
163      }),
164    )
165 
166    const rows = yield* Account.use.orgsByAccount().pipe(Effect.provide(live(client)))
167 
168    expect(rows.map((row) => [row.account.id, row.orgs.map((org) => org.id)]).map(([id, orgs]) => [id, orgs])).toEqual([
169      [AccountID.make("user-1"), [OrgID.make("org-1")]],
170      [AccountID.make("user-2"), [OrgID.make("org-2"), OrgID.make("org-3")]],
171    ])
172    expect(seen).toEqual(["GET https://one.example.com/api/orgs", "GET https://two.example.com/api/orgs"])
173  }),
174)
175 
176it.live("remove switches to another org when the active account is removed", () =>
177  Effect.gen(function* () {
178    const first = AccountID.make("user-1")
179    const second = AccountID.make("user-2")
180 
181    yield* AccountRepo.Service.use((r) =>
182      r.persistAccount({
183        id: first,
184        email: "one@example.com",
185        url: "https://one.example.com",
186        accessToken: AccessToken.make("at_1"),
187        refreshToken: RefreshToken.make("rt_1"),
188        expiry: Date.now() + outsideEagerRefreshWindow,
189        orgID: Option.some(OrgID.make("org-1")),
190      }),
191    )
192 
193    yield* AccountRepo.Service.use((r) =>
194      r.persistAccount({
195        id: second,
196        email: "two@example.com",
197        url: "https://two.example.com",
198        accessToken: AccessToken.make("at_2"),
199        refreshToken: RefreshToken.make("rt_2"),
200        expiry: Date.now() + outsideEagerRefreshWindow,
201        orgID: Option.some(OrgID.make("org-2")),
202      }),
203    )
204 
205    const client = HttpClient.make((req) =>
206      Effect.succeed(
207        req.url === "https://one.example.com/api/orgs" ? json(req, [org("org-1", "One")]) : json(req, [], 404),
208      ),
209    )
210 
211    yield* Account.use.remove(second).pipe(Effect.provide(live(client)))
212 
213    const active = yield* AccountRepo.use.active()
214    expect(Option.getOrThrow(active)).toEqual(
215      expect.objectContaining({
216        id: first,
217        active_org_id: OrgID.make("org-1"),
218      }),
219    )
220  }),
221)
222 
223it.live("token refresh persists the new token", () =>
224  Effect.gen(function* () {
225    const id = AccountID.make("user-1")
226 
227    yield* AccountRepo.Service.use((r) =>
228      r.persistAccount({
229        id,
230        email: "user@example.com",
231        url: "https://one.example.com",
232        accessToken: AccessToken.make("at_old"),
233        refreshToken: RefreshToken.make("rt_old"),
234        expiry: Date.now() - 1_000,
235        orgID: Option.none(),
236      }),
237    )
238 
239    const client = HttpClient.make((req) =>
240      Effect.succeed(
241        req.url === "https://one.example.com/auth/device/token"
242          ? json(req, {
243              access_token: "at_new",
244              refresh_token: "rt_new",
245              expires_in: 60,
246            })
247          : json(req, {}, 404),
248      ),
249    )
250 
251    const token = yield* Account.use.token(id).pipe(Effect.provide(live(client)))
252 
253    expect(Option.getOrThrow(token)).toBeDefined()
254    expect(String(Option.getOrThrow(token))).toBe("at_new")
255 
256    const row = yield* AccountRepo.use.getRow(id)
257    const value = Option.getOrThrow(row)
258    expect(value.access_token).toBe(AccessToken.make("at_new"))
259    expect(value.refresh_token).toBe(RefreshToken.make("rt_new"))
260    expect(value.token_expiry).toBeGreaterThan(Date.now())
261  }),
262)
263 
264it.live("token refreshes before expiry when inside the eager refresh window", () =>
265  Effect.gen(function* () {
266    const id = AccountID.make("user-1")
267 
268    yield* AccountRepo.Service.use((r) =>
269      r.persistAccount({
270        id,
271        email: "user@example.com",
272        url: "https://one.example.com",
273        accessToken: AccessToken.make("at_old"),
274        refreshToken: RefreshToken.make("rt_old"),
275        expiry: Date.now() + insideEagerRefreshWindow,
276        orgID: Option.none(),
277      }),
278    )
279 
280    let refreshCalls = 0
281    const client = HttpClient.make((req) =>
282      Effect.promise(async () => {
283        if (req.url === "https://one.example.com/auth/device/token") {
284          refreshCalls += 1
285          return json(req, {
286            access_token: "at_new",
287            refresh_token: "rt_new",
288            expires_in: 60,
289          })
290        }
291 
292        return json(req, {}, 404)
293      }),
294    )
295 
296    const token = yield* Account.use.token(id).pipe(Effect.provide(live(client)))
297 
298    expect(String(Option.getOrThrow(token))).toBe("at_new")
299    expect(refreshCalls).toBe(1)
300 
301    const row = yield* AccountRepo.use.getRow(id)
302    const value = Option.getOrThrow(row)
303    expect(value.access_token).toBe(AccessToken.make("at_new"))
304    expect(value.refresh_token).toBe(RefreshToken.make("rt_new"))
305  }),
306)
307 
308it.live("concurrent config and token requests coalesce token refresh", () =>
309  Effect.gen(function* () {
310    const id = AccountID.make("user-1")
311 
312    yield* AccountRepo.Service.use((r) =>
313      r.persistAccount({
314        id,
315        email: "user@example.com",
316        url: "https://one.example.com",
317        accessToken: AccessToken.make("at_old"),
318        refreshToken: RefreshToken.make("rt_old"),
319        expiry: Date.now() - 1_000,
320        orgID: Option.some(OrgID.make("org-9")),
321      }),
322    )
323 
324    let refreshCalls = 0
325    const client = HttpClient.make((req) =>
326      Effect.promise(async () => {
327        if (req.url === "https://one.example.com/auth/device/token") {
328          refreshCalls += 1
329 
330          if (refreshCalls === 1) {
331            await new Promise((resolve) => setTimeout(resolve, 25))
332            return json(req, {
333              access_token: "at_new",
334              refresh_token: "rt_new",
335              expires_in: 60,
336            })
337          }
338 
339          return json(
340            req,
341            {
342              error: "invalid_grant",
343              error_description: "refresh token already used",
344            },
345            400,
346          )
347        }
348 
349        if (req.url === "https://one.example.com/api/config") {
350          return json(req, { config: { theme: "light", seats: 5 } })
351        }
352 
353        return json(req, {}, 404)
354      }),
355    )
356 
357    const [cfg, token] = yield* Account.Service.use((s) =>
358      Effect.all([s.config(id, OrgID.make("org-9")), s.token(id)], { concurrency: 2 }),
359    ).pipe(Effect.provide(live(client)))
360 
361    expect(Option.getOrThrow(cfg)).toEqual({ theme: "light", seats: 5 })
362    expect(String(Option.getOrThrow(token))).toBe("at_new")
363    expect(refreshCalls).toBe(1)
364 
365    const row = yield* AccountRepo.use.getRow(id)
366    const value = Option.getOrThrow(row)
367    expect(value.access_token).toBe(AccessToken.make("at_new"))
368    expect(value.refresh_token).toBe(RefreshToken.make("rt_new"))
369  }),
370)
371 
372it.live("config sends the selected org header", () =>
373  Effect.gen(function* () {
374    const id = AccountID.make("user-1")
375 
376    yield* AccountRepo.Service.use((r) =>
377      r.persistAccount({
378        id,
379        email: "user@example.com",
380        url: "https://one.example.com",
381        accessToken: AccessToken.make("at_1"),
382        refreshToken: RefreshToken.make("rt_1"),
383        expiry: Date.now() + outsideEagerRefreshWindow,
384        orgID: Option.none(),
385      }),
386    )
387 
388    const seen: { auth?: string; org?: string } = {}
389    const client = HttpClient.make((req) =>
390      Effect.gen(function* () {
391        seen.auth = req.headers.authorization
392        seen.org = req.headers["x-org-id"]
393 
394        if (req.url === "https://one.example.com/api/config") {
395          return json(req, { config: { theme: "light", seats: 5 } })
396        }
397 
398        return json(req, {}, 404)
399      }),
400    )
401 
402    const cfg = yield* Account.Service.use((s) => s.config(id, OrgID.make("org-9"))).pipe(Effect.provide(live(client)))
403 
404    expect(Option.getOrThrow(cfg)).toEqual({ theme: "light", seats: 5 })
405    expect(seen).toEqual({
406      auth: "Bearer at_1",
407      org: "org-9",
408    })
409  }),
410)
411 
412it.live("poll stores the account and first org on success", () =>
413  Effect.gen(function* () {
414    const client = HttpClient.make((req) =>
415      Effect.succeed(
416        req.url === "https://one.example.com/auth/device/token"
417          ? json(req, {
418              access_token: "at_1",
419              refresh_token: "rt_1",
420              token_type: "Bearer",
421              expires_in: 60,
422            })
423          : req.url === "https://one.example.com/api/user"
424            ? json(req, { id: "user-1", email: "user@example.com" })
425            : req.url === "https://one.example.com/api/orgs"
426              ? json(req, [org("org-1", "One")])
427              : json(req, {}, 404),
428      ),
429    )
430 
431    const res = yield* Account.Service.use((s) => s.poll(login())).pipe(Effect.provide(live(client)))
432 
433    expect(res._tag).toBe("PollSuccess")
434    if (res._tag === "PollSuccess") {
435      expect(res.email).toBe("user@example.com")
436    }
437 
438    const active = yield* AccountRepo.use.active()
439    expect(Option.getOrThrow(active)).toEqual(
440      expect.objectContaining({
441        id: "user-1",
442        email: "user@example.com",
443        active_org_id: "org-1",
444      }),
445    )
446  }),
447)
448 
449for (const [name, body, expectedTag] of [
450  [
451    "pending",
452    {
453      error: "authorization_pending",
454      error_description: "The authorization request is still pending",
455    },
456    "PollPending",
457  ],
458  [
459    "slow",
460    {
461      error: "slow_down",
462      error_description: "Polling too frequently, please slow down",
463    },
464    "PollSlow",
465  ],
466  [
467    "denied",
468    {
469      error: "access_denied",
470      error_description: "The authorization request was denied",
471    },
472    "PollDenied",
473  ],
474  [
475    "expired",
476    {
477      error: "expired_token",
478      error_description: "The device code has expired",
479    },
480    "PollExpired",
481  ],
482] as const) {
483  it.live(`poll returns ${name} for ${body.error}`, () =>
484    Effect.gen(function* () {
485      const result = yield* poll(body)
486      expect(result._tag).toBe(expectedTag)
487    }),
488  )
489}
490 
491it.live("poll returns poll error for other OAuth errors", () =>
492  Effect.gen(function* () {
493    const result = yield* poll({
494      error: "server_error",
495      error_description: "An unexpected error occurred",
496    })
497 
498    expect(result._tag).toBe("PollError")
499    if (result._tag === "PollError") {
500      expect(String(result.cause)).toContain("server_error")
501    }
502  }),
503)
504