@gjermundgaraba/effect-actions 0.19.0 → 0.21.0

package/examples/kitchen-sink/test/attachments/attachments.test.ts

@@ -1,21 +1,26 @@
 import { Buffer } from "node:buffer";
+
 import { describe, expect, it } from "@effect/vitest";
-import { Array, Effect, flow, Layer } from "effect";
-import { HttpClient, HttpClientRequest } from "effect/http";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
 import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
 import * as ActionMcp from "@gjermundgaraba/effect-actions/ActionMcp";
 import * as Testing from "@gjermundgaraba/effect-actions/Testing";
+import { Array, Effect, flow, Layer } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+
 import { Http } from "../../src/Api.js";
 import { GetAttachment } from "../../src/attachments/Attachments.js";
 import { RateLimited } from "../../src/issues/Issues.js";
-import { memory } from "../../src/memory.js";
 import { publicRoutes } from "../../src/routes.js";
+import { services } from "../support/services.js";
 
-const served = Testing.layer(publicRoutes).pipe(Layer.provide(memory));
+const served = Testing.layer(publicRoutes).pipe(Layer.provide(services()));
 
 const signedIn = (token: string, workspace: string) =>
-  flow(HttpClientRequest.bearerToken(token), HttpClientRequest.setHeader("x-workspace", workspace));
+  flow(
+    HttpClientRequest.bearerToken(token),
+    HttpClientRequest.setHeader("x-workspace", workspace)
+  );
 
 const as = (token: string, workspace: string) => ({
   transformClient: HttpClient.mapRequest(signedIn(token, workspace)),
@@ -24,7 +29,7 @@ const as = (token: string, workspace: string) => ({
 // A one-pixel PNG stands in for a screenshot.
 const screenshot = Buffer.from(
   "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=",
-  "base64",
+  "base64"
 );
 
 const attached = Effect.gen(function* () {
@@ -39,55 +44,67 @@ const attached = Effect.gen(function* () {
 });
 
 describe("attachments, over HTTP and MCP", () => {
-  it.effect("decodes an image over HTTP, and reads it as an image block from the tool", () =>
-    Effect.gen(function* () {
-      const attachment = yield* attached;
-      const http = yield* ActionHttp.client(Http, as("ada", "acme"));
-      const mcp = yield* ActionMcp.client([GetAttachment], as("ada", "acme"));
-
-      expect(attachment).toMatchObject({ name: "crash.png", mimeType: "image/png", size: 68 });
-
-      // Both clients decode the same success, the bytes a `Uint8Array` again.
-      const overHttp = yield* http.getAttachment({ id: attachment.id });
-      const overMcp = yield* mcp.getAttachment({ id: attachment.id });
-
-      expect(Buffer.from(overHttp.image.data).equals(screenshot)).toBe(true);
-      expect(overMcp).toEqual(overHttp);
-
-      // As sent: the tool's result holds the rest of the success as JSON, and the image as a
-      // content block of its own, which a model receives as an image.
-      const call = yield* HttpClient.execute(
-        ActionMcp.request(
-          "tools/call",
-          { name: "getAttachment", arguments: { id: attachment.id } },
-          { headers: { authorization: "Bearer ada", "x-workspace": "acme" } },
-        ),
-      );
+  it.effect(
+    "decodes an image over HTTP, and reads it as an image block from the tool",
+    () =>
+      Effect.gen(function* () {
+        const attachment = yield* attached;
+        const http = yield* ActionHttp.client(Http, as("ada", "acme"));
+        const mcp = yield* ActionMcp.client([GetAttachment], as("ada", "acme"));
+
+        expect(attachment).toMatchObject({
+          name: "crash.png",
+          mimeType: "image/png",
+          size: 68,
+        });
+
+        // Both clients decode the same success, the bytes a `Uint8Array` again.
+        const overHttp = yield* http.getAttachment({ id: attachment.id });
+        const overMcp = yield* mcp.getAttachment({ id: attachment.id });
+
+        expect(Buffer.from(overHttp.image.data).equals(screenshot)).toBe(true);
+        expect(overMcp).toStrictEqual(overHttp);
+
+        // As sent: the tool's result holds the rest of the success as JSON, and the image as a
+        // content block of its own, which a model receives as an image.
+        const call = yield* HttpClient.execute(
+          ActionMcp.request(
+            "tools/call",
+            { name: "getAttachment", arguments: { id: attachment.id } },
+            { headers: { authorization: "Bearer ada", "x-workspace": "acme" } }
+          )
+        );
 
-      const text = yield* call.text;
+        const text = yield* call.text;
 
-      expect(text).toContain('"type":"image"');
-      expect(text).toContain('"mimeType":"image/png"');
-      expect(text).toContain(`"structuredContent":{"attachment":{"id":"${attachment.id}"`);
-    }).pipe(Effect.provide(served)),
+        expect(text).toContain('"type":"image"');
+        expect(text).toContain('"mimeType":"image/png"');
+        expect(text).toContain(
+          `"structuredContent":{"attachment":{"id":"${attachment.id}"`
+        );
+      }).pipe(Effect.provide(served))
   );
 
-  it.effect("refuses a file that is no image as invalid input, naming the field", () =>
-    Effect.gen(function* () {
-      const ada = yield* ActionHttp.client(Http, as("ada", "acme"));
-      const issue = yield* ada.createIssue({ title: "Crash", body: "" });
-
-      const refused = yield* Effect.flip(
-        ada.attachImage({
-          issue: issue.id,
-          name: "notes.txt",
-          image: { data: screenshot, mimeType: "text/plain" },
-        }),
-      );
+  it.effect(
+    "refuses a file that is no image as invalid input, naming the field",
+    () =>
+      Effect.gen(function* () {
+        const ada = yield* ActionHttp.client(Http, as("ada", "acme"));
+        const issue = yield* ada.createIssue({ title: "Crash", body: "" });
+
+        const refused = yield* Effect.flip(
+          ada.attachImage({
+            issue: issue.id,
+            name: "notes.txt",
+            image: { data: screenshot, mimeType: "text/plain" },
+          })
+        );
 
-      expect(refused).toBeInstanceOf(Action.InvalidInput);
-      expect(refused).toMatchObject({ issues: [{ path: ["image", "mimeType"] }] });
-    }).pipe(Effect.provide(served)),
+        expect(refused).toBeInstanceOf(Action.InvalidInput);
+        expect(refused).toMatchObject({
+          issues: [{ path: ["image", "mimeType"] }],
+        });
+      }).pipe(Effect.provide(served))
   );
 
   it.effect("counts an attachment against the issues' write limit", () =>
@@ -97,7 +114,7 @@ describe("attachments, over HTTP and MCP", () => {
 
       // `attached` spent two writes, an issue and its image. Eight comments spend the rest.
       yield* Effect.forEach(Array.range(1, 8), (n) =>
-        ada.commentOnIssue({ id: attachment.issue, text: `Comment ${n}` }),
+        ada.commentOnIssue({ id: attachment.issue, text: `Comment ${n}` })
       );
 
       const refused = yield* Effect.flip(
@@ -105,57 +122,81 @@ describe("attachments, over HTTP and MCP", () => {
           issue: attachment.issue,
           name: "again.png",
           image: { data: screenshot, mimeType: "image/png" },
-        }),
+        })
       );
 
       expect(refused).toBeInstanceOf(RateLimited);
-    }).pipe(Effect.provide(served)),
+    }).pipe(Effect.provide(served))
   );
 
-  it.effect("serves the bytes to the web app's cookie, from the host's own route", () =>
-    Effect.gen(function* () {
-      const attachment = yield* attached;
+  it.effect(
+    "serves the bytes to the web app's cookie, from the host's own route",
+    () =>
+      Effect.gen(function* () {
+        const attachment = yield* attached;
+
+        const download = (session: string) =>
+          HttpClient.execute(
+            HttpClientRequest.get(`/attachments/${attachment.id}`).pipe(
+              HttpClientRequest.setHeader(
+                "cookie",
+                `tracker_session=${session}`
+              )
+            )
+          );
+
+        const mine = yield* download("ada-at-acme");
+        const anotherWorkspace = yield* download("grace-at-globex");
+
+        expect(mine.status).toBe(200);
+        expect(Buffer.from(yield* mine.arrayBuffer).equals(screenshot)).toBe(
+          true
+        );
+        expect(mine.headers["cache-control"]).toBe(
+          "private, max-age=31536000, immutable"
+        );
+        // An uploaded image opened by its URL is a document on this origin: it gets no scripts.
+        expect([
+          mine.headers["content-security-policy"],
+          mine.headers["x-content-type-options"],
+        ]).toStrictEqual(["sandbox", "nosniff"]);
+        expect(anotherWorkspace.status).toBe(404);
+      }).pipe(Effect.provide(served))
+  );
+
+  it.effect(
+    "refuses, on that route, whom authentication and the route's rule refuse",
+    () =>
+      Effect.gen(function* () {
+        const attachment = yield* attached;
+        const download = HttpClientRequest.get(`/attachments/${attachment.id}`);
 
-      const download = (session: string) =>
-        HttpClient.execute(
-          HttpClientRequest.get(`/attachments/${attachment.id}`).pipe(
-            HttpClientRequest.setHeader("cookie", `tracker_session=${session}`),
-          ),
+        const withCookie = HttpClientRequest.setHeader(
+          "cookie",
+          "tracker_session=kay-at-acme"
         );
 
-      const mine = yield* download("ada-at-acme");
-      const anotherWorkspace = yield* download("grace-at-globex");
-
-      expect(mine.status).toBe(200);
-      expect(Buffer.from(yield* mine.arrayBuffer).equals(screenshot)).toBe(true);
-      expect(mine.headers["cache-control"]).toBe("private, max-age=31536000, immutable");
-      // An uploaded image opened by its URL is a document on this origin: it gets no scripts.
-      expect([
-        mine.headers["content-security-policy"],
-        mine.headers["x-content-type-options"],
-      ]).toEqual(["sandbox", "nosniff"]);
-      expect(anotherWorkspace.status).toBe(404);
-    }).pipe(Effect.provide(served)),
-  );
+        const signedOut = yield* HttpClient.execute(download);
 
-  it.effect("refuses, on that route, whom authentication and the route's rule refuse", () =>
-    Effect.gen(function* () {
-      const attachment = yield* attached;
-      const download = HttpClientRequest.get(`/attachments/${attachment.id}`);
-      const withCookie = HttpClientRequest.setHeader("cookie", "tracker_session=kay-at-acme");
-
-      const signedOut = yield* HttpClient.execute(download);
-      const withToken = yield* HttpClient.execute(signedIn("ada", "acme")(download));
-      const withoutScope = yield* HttpClient.execute(withCookie(download));
-
-      // A cookie scheme has no challenge. A token is no credential on this route.
-      expect([signedOut.status, signedOut.headers["cache-control"]]).toEqual([401, "no-store"]);
-      expect(signedOut.headers["www-authenticate"]).toBeUndefined();
-      expect(withToken.status).toBe(401);
-      // kay is signed in, in the right workspace, without the read scope: the route's own
-      // `authorize` refuses.
-      expect(withoutScope.status).toBe(403);
-      expect(yield* withoutScope.json).toMatchObject({ message: "Requires issues:read." });
-    }).pipe(Effect.provide(served)),
+        const withToken = yield* HttpClient.execute(
+          signedIn("ada", "acme")(download)
+        );
+
+        const withoutScope = yield* HttpClient.execute(withCookie(download));
+
+        // A cookie scheme has no challenge. A token is no credential on this route.
+        expect([
+          signedOut.status,
+          signedOut.headers["cache-control"],
+        ]).toStrictEqual([401, "no-store"]);
+        expect(signedOut.headers["www-authenticate"]).toBeUndefined();
+        expect(withToken.status).toBe(401);
+        // kay is signed in, in the right workspace, without the read scope: the route's own
+        // `authorize` refuses.
+        expect(withoutScope.status).toBe(403);
+        expect(yield* withoutScope.json).toMatchObject({
+          message: "Requires issues:read.",
+        });
+      }).pipe(Effect.provide(served))
   );
 });

package/examples/kitchen-sink/test/identity/identity.test.ts

@@ -1,63 +1,77 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Array, Effect, flow, Layer } from "effect";
-import { HttpClient, HttpClientRequest } from "effect/http";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
 import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
 import * as ActionMcp from "@gjermundgaraba/effect-actions/ActionMcp";
 import * as Testing from "@gjermundgaraba/effect-actions/Testing";
+import { Array, Effect, flow, Layer } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+
 import { Http } from "../../src/Api.js";
 import { Directory } from "../../src/identity/directory.js";
-import { IssuerUnavailable, Login, QuotaExceeded, WhoAmI } from "../../src/identity/Identity.js";
-import { memory } from "../../src/memory.js";
+import {
+  IssuerUnavailable,
+  Login,
+  QuotaExceeded,
+  WhoAmI,
+} from "../../src/identity/Identity.js";
 import { publicRoutes } from "../../src/routes.js";
+import { services } from "../support/services.js";
 
 // What authentication adds on the wire: the public port behind its real providers, answering
 // in memory. A caller is the credential its client sends.
-const served = Testing.layer(publicRoutes).pipe(Layer.provide(memory));
+const served = Testing.layer(publicRoutes).pipe(Layer.provide(services()));
 
-// A test replaces the one service it is about. Provided before `memory`, this layer is the
-// `Directory` the routes are built with; `memory` gives them the rest.
+// A test replaces the one service it is about. Provided before `services`, this layer is the
+// `Directory` the routes are built with; `services` gives them the rest.
 const servedWith = (directory: Layer.Layer<Directory>) =>
-  Testing.layer(publicRoutes).pipe(Layer.provide(directory), Layer.provide(memory));
+  Testing.layer(publicRoutes).pipe(
+    Layer.provide(directory),
+    Layer.provide(services())
+  );
 
 // A directory that cannot reach its issuer.
 const issuerDown = Layer.succeed(
   Directory,
   Directory.of({
-    ofToken: () => Effect.fail(new IssuerUnavailable({ retryAfterSeconds: 30 })),
+    ofToken: () =>
+      Effect.fail(new IssuerUnavailable({ retryAfterSeconds: 30 })),
     ofSession: () => Effect.fail(new Action.Unauthenticated()),
-  }),
+  })
 );
 
 const as = (token: string, workspace: string) => ({
   transformClient: HttpClient.mapRequest(
     flow(
       HttpClientRequest.bearerToken(token),
-      HttpClientRequest.setHeader("x-workspace", workspace),
-    ),
+      HttpClientRequest.setHeader("x-workspace", workspace)
+    )
   ),
 });
 
 describe("a bearer token", () => {
-  it.effect("makes the caller the member it is in the workspace the request names", () =>
-    Effect.gen(function* () {
-      const atAcme = yield* ActionHttp.client(Http, as("ada", "acme"));
-      const atGlobex = yield* ActionHttp.client(Http, as("ada", "globex"));
-      const elsewhere = yield* ActionHttp.client(Http, as("linus", "globex"));
-
-      expect(yield* atAcme.whoAmI()).toMatchObject({ workspace: "acme" });
-      expect(yield* atGlobex.whoAmI()).toEqual({
-        id: "ada",
-        workspace: "globex",
-        scopes: ["issues:read"],
-      });
-
-      // A member of acme alone, asking for globex: refused, with no scope to step up to.
-      const refused = yield* Effect.flip(elsewhere.whoAmI());
-
-      expect(refused).toBeInstanceOf(Action.Forbidden);
-      expect(refused.message).toBe("Name a workspace you belong to in the X-Workspace header.");
-    }).pipe(Effect.provide(served)),
+  it.effect(
+    "makes the caller the member it is in the workspace the request names",
+    () =>
+      Effect.gen(function* () {
+        const atAcme = yield* ActionHttp.client(Http, as("ada", "acme"));
+        const atGlobex = yield* ActionHttp.client(Http, as("ada", "globex"));
+        const elsewhere = yield* ActionHttp.client(Http, as("linus", "globex"));
+
+        expect(yield* atAcme.whoAmI()).toMatchObject({ workspace: "acme" });
+        expect(yield* atGlobex.whoAmI()).toStrictEqual({
+          id: "ada",
+          workspace: "globex",
+          scopes: ["issues:read"],
+        });
+
+        // A member of acme alone, asking for globex: refused, with no scope to step up to.
+        const refused = yield* Effect.flip(elsewhere.whoAmI());
+
+        expect(refused).toBeInstanceOf(Action.Forbidden);
+        expect(refused.message).toBe(
+          "Name a workspace you belong to in the X-Workspace header."
+        );
+      }).pipe(Effect.provide(served))
   );
 
   it.effect(
@@ -66,78 +80,92 @@ describe("a bearer token", () => {
       Effect.gen(function* () {
         const reader = yield* ActionHttp.client(Http, as("linus", "acme"));
 
-        const refused = yield* Effect.flip(reader.createIssue({ title: "Crash", body: "" }));
+        const refused = yield* Effect.flip(
+          reader.createIssue({ title: "Crash", body: "" })
+        );
 
-        expect(refused).toEqual(new Action.Forbidden({ scopes: ["issues:write"] }));
+        expect(refused).toStrictEqual(
+          new Action.Forbidden({ scopes: ["issues:write"] })
+        );
         expect(refused.message).toBe("Requires issues:write.");
 
         // The same refusal as sent: the 403 an OAuth client re-authorizes on.
-        const response = yield* HttpClientRequest.post("/api/v1/closeIssue").pipe(
+        const response = yield* HttpClientRequest.post(
+          "/api/v1/closeIssue"
+        ).pipe(
           HttpClientRequest.bearerToken("linus"),
           HttpClientRequest.setHeader("x-workspace", "acme"),
           HttpClientRequest.bodyJsonUnsafe({ id: "ACME-1" }),
-          HttpClient.execute,
+          HttpClient.execute
         );
 
         expect(response.status).toBe(403);
         expect(response.headers["www-authenticate"]).toContain(
-          'error="insufficient_scope", scope="issues:write"',
+          'error="insufficient_scope", scope="issues:write"'
         );
-      }).pipe(Effect.provide(served)),
+      }).pipe(Effect.provide(served))
   );
 
-  it.effect("finds where to sign in: published discovery, named in the challenge of a 401", () =>
-    Effect.gen(function* () {
-      const discovery = yield* HttpClient.get("/.well-known/oauth-protected-resource/mcp");
-
-      expect(yield* discovery.json).toMatchObject({
-        resource: "http://localhost:3000/mcp",
-        scopes_supported: ["issues:read", "issues:write"],
-      });
-
-      // A protected tool's call without a token: the endpoint's own 401, before any tool runs.
-      const refused = yield* HttpClient.execute(
-        ActionMcp.request("tools/call", { name: "whoAmI", arguments: {} }),
-      );
-
-      expect(refused.status).toBe(401);
-      expect(refused.headers["www-authenticate"]).toBe(
-        'Bearer scope="issues:read", resource_metadata="http://localhost:3000/.well-known/oauth-protected-resource/mcp"',
-      );
-    }).pipe(Effect.provide(served)),
+  it.effect(
+    "finds where to sign in: published discovery, named in the challenge of a 401",
+    () =>
+      Effect.gen(function* () {
+        const discovery = yield* HttpClient.get(
+          "/.well-known/oauth-protected-resource/mcp"
+        );
+
+        expect(yield* discovery.json).toMatchObject({
+          resource: "http://localhost:3000/mcp",
+          scopes_supported: ["issues:read", "issues:write"],
+        });
+
+        // A protected tool's call without a token: the endpoint's own 401, before any tool runs.
+        const refused = yield* HttpClient.execute(
+          ActionMcp.request("tools/call", { name: "whoAmI", arguments: {} })
+        );
+
+        expect(refused.status).toBe(401);
+        expect(refused.headers["www-authenticate"]).toBe(
+          'Bearer scope="issues:read", resource_metadata="http://localhost:3000/.well-known/oauth-protected-resource/mcp"'
+        );
+      }).pipe(Effect.provide(served))
   );
 
-  it.effect("fails with the verifier's declared error, a typed 503, when the issuer is down", () =>
-    Effect.gen(function* () {
-      const http = yield* ActionHttp.client(Http, as("ada", "acme"));
-
-      // Over MCP it is the endpoint's HTTP answer, before any tool runs, not a tool's result: the
-      // client decodes it given the descriptor the endpoint serves with.
-      const mcp = yield* ActionMcp.client([WhoAmI], {
-        ...as("ada", "acme"),
-        authentication: Login,
-      });
-
-      expect(yield* Effect.flip(http.whoAmI())).toEqual(
-        new IssuerUnavailable({ retryAfterSeconds: 30 }),
-      );
-      expect(yield* Effect.flip(mcp.whoAmI())).toEqual(
-        new IssuerUnavailable({ retryAfterSeconds: 30 }),
-      );
-    }).pipe(Effect.provide(servedWith(issuerDown))),
+  it.effect(
+    "fails with the verifier's declared error, a typed 503, when the issuer is down",
+    () =>
+      Effect.gen(function* () {
+        const http = yield* ActionHttp.client(Http, as("ada", "acme"));
+
+        // Over MCP it is the endpoint's HTTP answer, before any tool runs, not a tool's result: the
+        // client decodes it given the descriptor the endpoint serves with.
+        const mcp = yield* ActionMcp.client([WhoAmI], {
+          ...as("ada", "acme"),
+          authentication: Login,
+        });
+
+        expect(yield* Effect.flip(http.whoAmI())).toStrictEqual(
+          new IssuerUnavailable({ retryAfterSeconds: 30 })
+        );
+        expect(yield* Effect.flip(mcp.whoAmI())).toStrictEqual(
+          new IssuerUnavailable({ retryAfterSeconds: 30 })
+        );
+      }).pipe(Effect.provide(servedWith(issuerDown)))
   );
 });
 
 describe("the request quota", () => {
-  it.effect("is spent per member, and answered as the binding's typed error", () =>
-    Effect.gen(function* () {
-      const ada = yield* ActionHttp.client(Http, as("ada", "acme"));
-      const grace = yield* ActionHttp.client(Http, as("grace", "globex"));
+  it.effect(
+    "is spent per member, and answered as the binding's typed error",
+    () =>
+      Effect.gen(function* () {
+        const ada = yield* ActionHttp.client(Http, as("ada", "acme"));
+        const grace = yield* ActionHttp.client(Http, as("grace", "globex"));
 
-      yield* Effect.forEach(Array.range(1, 60), () => ada.whoAmI());
+        yield* Effect.forEach(Array.range(1, 60), () => ada.whoAmI());
 
-      expect(yield* Effect.flip(ada.whoAmI())).toBeInstanceOf(QuotaExceeded);
-      expect(yield* grace.whoAmI()).toMatchObject({ id: "grace" });
-    }).pipe(Effect.provide(served)),
+        expect(yield* Effect.flip(ada.whoAmI())).toBeInstanceOf(QuotaExceeded);
+        expect(yield* grace.whoAmI()).toMatchObject({ id: "grace" });
+      }).pipe(Effect.provide(served))
   );
 });