@knpkv/atlassian-common 1.5.0 → 1.6.0

package/src/cli-auth/internal/oauthServer.ts

@@ -0,0 +1,168 @@
+/**
+ * Local HTTP callback server for OAuth2 authorization code capture.
+ *
+ * **Mental model**
+ *
+ * - **Scope-owned lifecycle**: {@link startCallbackServer} returns a `codePromise`
+ *   (Deferred). The server validates the CSRF `state` parameter, resolves the
+ *   Deferred with the authorization code, and stops when its enclosing scope closes.
+ * - **Port auto-discovery**: Tries default port 8585, increments on conflict up to 8594.
+ * - **Ready before return**: the handler is installed before the port is handed back,
+ *   so the caller never advertises a callback URL nothing answers.
+ *
+ * @internal
+ */
+import * as Context from "effect/Context"
+import * as Deferred from "effect/Deferred"
+import * as Effect from "effect/Effect"
+import { HttpRouter, HttpServer, HttpServerRequest, HttpServerResponse } from "effect/http"
+import type * as HttpServerError from "effect/http/HttpServerError"
+import * as Layer from "effect/Layer"
+import { NetAddress } from "effect/net"
+import * as Schema from "effect/Schema"
+import * as Scope from "effect/Scope"
+import { OAuthError } from "../../auth/OAuthErrors.js"
+
+const DEFAULT_PORT = 8585
+const MAX_PORT = 8594
+type HttpServerInstance = Effect.Success<typeof HttpServer.HttpServer>
+
+/**
+ * Creates the platform HTTP server for one listen attempt. The Node adapter is
+ * {@link HttpServerFactoryLive}; tests substitute ephemeral or failing servers.
+ */
+export interface HttpServerFactory {
+  readonly createServerLayer: (options: CallbackServerListenOptions) => Layer.Layer<
+    HttpServer.HttpServer,
+    HttpServerError.ServeError,
+    never
+  >
+}
+
+export interface CallbackServerListenOptions {
+  readonly host: "localhost"
+  readonly port: number
+}
+
+export const callbackServerListenOptions = (port: number): CallbackServerListenOptions => ({
+  host: "localhost",
+  port
+})
+
+export const callbackUrl = (port: number): string => `http://localhost:${port}/callback`
+
+export class HttpServerFactoryTag extends Context.Service<
+  HttpServerFactoryTag,
+  HttpServerFactory
+>()("@knpkv/atlassian-common/cli-auth/HttpServerFactory") {}
+
+/** Builds a {@link HttpServerFactoryTag} layer from a per-attempt server layer. */
+export const makeHttpServerFactory = (
+  createLayerFn: (
+    options: CallbackServerListenOptions
+  ) => Layer.Layer<HttpServer.HttpServer, HttpServerError.ServeError, never>
+): Layer.Layer<HttpServerFactoryTag> =>
+  Layer.succeed(HttpServerFactoryTag, {
+    createServerLayer: createLayerFn
+  })
+
+export interface CallbackServerResult {
+  /** Resolves with the authorization code, or fails with the provider's error. */
+  readonly codePromise: Effect.Effect<string, OAuthError>
+  /** The port the server is listening on */
+  readonly port: number
+}
+
+const AddressInUseCause = Schema.Struct({
+  code: Schema.Literal("EADDRINUSE")
+})
+
+const isAddressInUse = (error: HttpServerError.ServeError): boolean => Schema.is(AddressInUseCause)(error.cause)
+
+const page = (heading: string, body: string) =>
+  HttpServerResponse.html(`<html><body><h1>${heading}</h1><p>${body}</p></body></html>`)
+
+/**
+ * Start a local HTTP server to receive the OAuth callback for `expectedState`.
+ *
+ * Fails with one `OAuthError` (step `authorize`) when no port in range can be
+ * bound; the server stops when the enclosing scope closes.
+ */
+export const startCallbackServer = (
+  expectedState: string
+): Effect.Effect<CallbackServerResult, OAuthError, HttpServerFactoryTag | Scope.Scope> =>
+  Effect.gen(function*() {
+    const factory = yield* HttpServerFactoryTag
+    const deferred = yield* Deferred.make<string, OAuthError>()
+    const scope = yield* Effect.scope
+
+    // Map to OAuthError once, outside the retry, so a run of occupied ports
+    // does not nest one OAuthError inside another.
+    const buildServer = (port: number): Effect.Effect<HttpServerInstance, HttpServerError.ServeError> =>
+      Layer.build(factory.createServerLayer(callbackServerListenOptions(port))).pipe(
+        Scope.provide(scope),
+        Effect.map((context) => Context.get(context, HttpServer.HttpServer)),
+        Effect.catchIf(
+          (error) => isAddressInUse(error) && port < MAX_PORT,
+          () => buildServer(port + 1)
+        )
+      )
+
+    const server = yield* buildServer(DEFAULT_PORT).pipe(
+      Effect.mapError((cause) => new OAuthError({ step: "authorize", cause }))
+    )
+
+    if (!NetAddress.isInetAddress(server.address)) {
+      return yield* new OAuthError({ step: "authorize", cause: "OAuth callback server must listen on a TCP port" })
+    }
+    const port = server.address.port
+
+    const router = yield* HttpRouter.make
+    yield* router.add(
+      "GET",
+      "/callback",
+      Effect.gen(function*() {
+        const req = yield* HttpServerRequest.HttpServerRequest
+        const url = new URL(req.url, callbackUrl(port))
+        const code = url.searchParams.get("code")
+        const state = url.searchParams.get("state")
+        const error = url.searchParams.get("error")
+        const errorDescription = url.searchParams.get("error_description")
+
+        if (state !== expectedState) {
+          return page("Security Error", "State verification failed.").pipe(HttpServerResponse.setStatus(403))
+        }
+
+        if (error !== null && error !== "") {
+          // An empty description is no description: report the error code instead.
+          yield* Deferred.fail(
+            deferred,
+            new OAuthError({
+              step: "authorize",
+              cause: errorDescription === null || errorDescription === "" ? error : errorDescription
+            })
+          )
+          return page("Authorization Failed", "You can close this window.")
+        }
+
+        if (code === null || code === "") {
+          yield* Deferred.fail(deferred, new OAuthError({ step: "authorize", cause: "No authorization code received" }))
+          return page("Error", "No authorization code received.")
+        }
+
+        yield* Deferred.succeed(deferred, code)
+        return page("Success!", "You can close this window and return to the terminal.")
+      })
+    )
+
+    // Installs the handler in this scope and returns; a failure to install
+    // surfaces here rather than leaving the caller waiting on a dead server.
+    yield* HttpServer.serveEffect(router.asHttpEffect()).pipe(
+      Effect.provideService(HttpServer.HttpServer, server)
+    )
+
+    return {
+      codePromise: Deferred.await(deferred),
+      port
+    }
+  })

package/src/cli-auth/openBrowser.ts

@@ -0,0 +1,47 @@
+/**
+ * Cross-platform browser launcher backed by Effect child process services.
+ *
+ * Tries `open`, then `xdg-open`, then `rundll32.exe`, stopping at the first that
+ * exits 0. A launcher that is missing or exits non-zero falls through to the next;
+ * when none succeeds the last failure is reported, typed, so the caller decides
+ * whether a browser that never opened is fatal.
+ *
+ * @module
+ */
+import * as Data from "effect/Data"
+import * as Effect from "effect/Effect"
+import type * as PlatformError from "effect/PlatformError"
+import { ChildProcess, ChildProcessSpawner } from "effect/process"
+
+/** A launcher ran but reported failure (for example `xdg-open` with no browser on a headless host). */
+export class BrowserOpenError extends Data.TaggedError("BrowserOpenError")<{
+  readonly command: string
+  readonly exitCode: number
+}> {}
+
+const run = (
+  command: string,
+  args: ReadonlyArray<string>
+): Effect.Effect<void, BrowserOpenError | PlatformError.PlatformError, ChildProcessSpawner.ChildProcessSpawner> =>
+  Effect.gen(function*() {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner
+    const exitCode = yield* spawner.exitCode(
+      ChildProcess.make(command, args, {
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "ignore"
+      })
+    )
+    if (exitCode !== 0) {
+      return yield* new BrowserOpenError({ command, exitCode })
+    }
+  })
+
+/** Open `url` in the user's browser. */
+export const openBrowser = (
+  url: string
+): Effect.Effect<void, BrowserOpenError | PlatformError.PlatformError, ChildProcessSpawner.ChildProcessSpawner> =>
+  run("open", [url]).pipe(
+    Effect.catch(() => run("xdg-open", [url])),
+    Effect.catch(() => run("rundll32.exe", ["url.dll,FileProtocolHandler", url]))
+  )

package/test/cliAuth.guardrails.test.ts

@@ -0,0 +1,76 @@
+/** @effect-diagnostics strictEffectProvide:skip-file */
+import { NodeServices } from "@effect/platform-node"
+import { describe, expect, it } from "@effect/vitest"
+import * as Effect from "effect/Effect"
+import * as FileSystem from "effect/FileSystem"
+import * as Path from "effect/Path"
+import { ChildProcess, ChildProcessSpawner } from "effect/process"
+import * as Schema from "effect/Schema"
+import * as Stream from "effect/Stream"
+import confluenceIntegration from "../../confluence-to-markdown/vitest.config.integration.js"
+import confluence from "../../confluence-to-markdown/vitest.config.js"
+import jiraIntegration from "../../jira-cli/vitest.config.integration.js"
+import jira from "../../jira-cli/vitest.config.js"
+import clockify from "../../jira-clockify/vitest.config.js"
+
+const configs = { jira, jiraIntegration, confluence, confluenceIntegration, clockify }
+const Findings = Schema.fromJsonString(Schema.Array(Schema.Struct({ file: Schema.String })))
+
+describe("CLI auth guardrails", () => {
+  for (const [name, config] of Object.entries(configs)) {
+    it(`${name} resolves CLI auth from source rather than stale build output`, () => {
+      expect(config.resolve?.alias).toHaveProperty(
+        "@knpkv/atlassian-common/cli-auth",
+        new URL("../src/cli-auth/index.ts", import.meta.url).pathname
+      )
+    })
+  }
+
+  it.effect("limits the reimplementation guard to the Jira and Confluence CLIs", () =>
+    Effect.gen(function*() {
+      const fs = yield* FileSystem.FileSystem
+      const path = yield* Path.Path
+      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner
+      const root = yield* path.fromFileUrl(new URL("../../../", import.meta.url))
+      const fixture = yield* fs.makeTempDirectoryScoped({ prefix: "cli-auth-guard-" })
+      yield* fs.writeFileString(
+        path.join(fixture, "sgconfig.yml"),
+        "ruleDirs: []\nlanguageGlobs:\n  tsx:\n    - \"**/*.ts\"\n"
+      )
+      // The same callback-server name and endpoint namespace are legitimate in
+      // another integration. Only the two delegated CLI implementations are banned.
+      const source = [
+        "import * as Auth from \"@knpkv/atlassian-common/auth\"",
+        "import { refreshToken } from \"@knpkv/atlassian-common/auth\"",
+        "const authUrl = Auth.buildAuthUrl({ clientId: \"client\" })",
+        "function startCallbackServer(state: string) { return state }"
+      ].join("\n")
+      for (const name of ["jira-cli", "confluence-to-markdown", "other-oauth"]) {
+        const directory = path.join(fixture, "packages", name, "src")
+        yield* fs.makeDirectory(directory, { recursive: true })
+        yield* fs.writeFileString(path.join(directory, "auth.ts"), source)
+      }
+      const handle = yield* spawner.spawn(ChildProcess.make(
+        path.join(root, "node_modules", ".bin", "ast-grep"),
+        [
+          "scan",
+          "--rule",
+          path.join(root, "ast-grep", "rules", "packaging", "no-atlassian-cli-auth-reimplementation.yml"),
+          "--json=compact",
+          "packages"
+        ],
+        { cwd: fixture }
+      ))
+      const { exitCode, stderr, stdout } = yield* Effect.all({
+        exitCode: handle.exitCode,
+        stdout: Stream.decodeText(handle.stdout).pipe(Stream.mkString),
+        stderr: Stream.decodeText(handle.stderr).pipe(Stream.mkString)
+      }, { concurrency: "unbounded" })
+      expect(exitCode, `${fixture}: ${stdout} ${stderr}`).toBe(1)
+      const findings = yield* Schema.decodeUnknownEffect(Findings)(stdout)
+      expect(findings.map(({ file }) => file).sort()).toEqual([
+        ...Array<string>(3).fill("packages/confluence-to-markdown/src/auth.ts"),
+        ...Array<string>(3).fill("packages/jira-cli/src/auth.ts")
+      ])
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)))
+})

package/test/cliAuth.login.test.ts

@@ -0,0 +1,319 @@
+/** @effect-diagnostics strictEffectProvide:skip-file */
+/**
+ * Browser login through the shared Atlassian CLI auth.
+ *
+ * The login prints the authorization URL before it tries to open a browser, so
+ * a browser that will not open must not end the login: the user can still visit
+ * the URL. A callback server that cannot bind, on the other hand, must end it
+ * before any URL is advertised, and the server must stop whenever the login's
+ * scope closes.
+ */
+import { NodeFileSystem, NodePath, NodeServices } from "@effect/platform-node"
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient"
+import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer"
+import { describe, expect, it } from "@effect/vitest"
+import { ConfigProvider } from "effect"
+import * as Console from "effect/Console"
+import * as Data from "effect/Data"
+import * as Deferred from "effect/Deferred"
+import * as Effect from "effect/Effect"
+import * as Fiber from "effect/Fiber"
+import * as FileSystem from "effect/FileSystem"
+import { HttpClient, HttpClientRequest, HttpClientResponse, HttpServer, HttpServerError } from "effect/http"
+import * as Layer from "effect/Layer"
+import { ChildProcessSpawner } from "effect/process"
+import * as Ref from "effect/Ref"
+import type * as Schema from "effect/Schema"
+import * as Sink from "effect/Sink"
+import * as Stream from "effect/Stream"
+import { TestClock } from "effect/testing"
+import { createServer } from "node:http"
+import { makeAtlassianCliAuth, makeHttpServerFactory } from "../src/cli-auth/index.js"
+import { loadActiveProfileToken } from "../src/config/AuthProfiles.js"
+import { HomeDirectoryLive } from "../src/config/ConfigPaths.js"
+import { saveOAuthConfig } from "../src/config/TokenStorage.js"
+
+const TOOL = "test-cli"
+
+class TestAuthMissing extends Data.TaggedError("TestAuthMissing") {}
+
+const authOptions = {
+  toolName: TOOL,
+  commandName: "test",
+  productName: "Test",
+  scopes: ["read:me", "offline_access"],
+  authMissing: () => new TestAuthMissing()
+}
+
+const storage = Layer.mergeAll(NodeFileSystem.layer, NodePath.layer, HomeDirectoryLive)
+
+const withHome = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  Effect.gen(function*() {
+    const fs = yield* FileSystem.FileSystem
+    const home = yield* fs.makeTempDirectoryScoped({ prefix: "atlassian-cli-login-" })
+    return yield* effect.pipe(
+      Effect.provide(ConfigProvider.layer(ConfigProvider.fromEnv({ env: { HOME: home } })))
+    )
+  }).pipe(Effect.scoped, Effect.provide(NodeFileSystem.layer))
+
+const seedConfig = saveOAuthConfig(TOOL, { clientId: "client-1", clientSecret: "secret-1" }).pipe(
+  Effect.provide(storage)
+)
+
+const json = (request: HttpClientRequest.HttpClientRequest, body: Schema.Json) =>
+  HttpClientResponse.fromWeb(
+    request,
+    new Response(JSON.stringify(body), { status: 200, headers: { "content-type": "application/json" } })
+  )
+
+// Atlassian's side of a successful login: token exchange, one site, the user.
+interface FakeSite {
+  readonly id: string
+  readonly name: string
+  readonly url: string
+}
+
+const firstSite: FakeSite = { id: "cloud-1", name: "Site", url: "https://site.atlassian.net" }
+const secondSite: FakeSite = { id: "cloud-2", name: "Other", url: "https://other.atlassian.net" }
+
+const atlassianClientWith = (sites: ReadonlyArray<FakeSite>) =>
+  Layer.succeed(
+    HttpClient.HttpClient,
+    HttpClient.make((request) => {
+      if (request.url.endsWith("/oauth/token")) {
+        return Effect.succeed(json(request, {
+          access_token: "access-1",
+          refresh_token: "refresh-1",
+          expires_in: 3600,
+          scope: "read:me offline_access",
+          token_type: "Bearer"
+        }))
+      }
+      if (request.url.endsWith("/accessible-resources")) {
+        return Effect.succeed(json(request, sites.map((site) => ({ ...site, scopes: [] }))))
+      }
+      return Effect.succeed(json(request, { account_id: "acc-1", name: "Ada", email: "ada@example.com" }))
+    })
+  )
+
+const atlassianClient = atlassianClientWith([firstSite])
+
+// Every launcher runs and reports failure — merged after NodeServices so it
+// replaces the real spawner rather than being replaced by it, the way `xdg-open` does on a host
+// with no browser. The first launch hands its URL to the test.
+const failingLaunchers = (launched: Deferred.Deferred<string>, attempts: Ref.Ref<ReadonlyArray<string>>) =>
+  Layer.succeed(
+    ChildProcessSpawner.ChildProcessSpawner,
+    ChildProcessSpawner.make((command) =>
+      Effect.gen(function*() {
+        if (command._tag === "StandardCommand") {
+          yield* Ref.update(attempts, (all) => [...all, command.command])
+          yield* Deferred.succeed(launched, command.args[command.args.length - 1] ?? "")
+        }
+        return ChildProcessSpawner.makeHandle({
+          all: Stream.empty,
+          exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(1)),
+          getInputFd: () => Sink.drain,
+          getOutputFd: () => Stream.empty,
+          isRunning: Effect.succeed(false),
+          kill: () => Effect.void,
+          pid: ChildProcessSpawner.ProcessId(1),
+          reref: Effect.void,
+          stderr: Stream.empty,
+          stdin: Sink.drain,
+          stdout: Stream.empty,
+          unref: Effect.succeed(Effect.void)
+        })
+      })
+    )
+  )
+
+// An ephemeral real server whose shutdown the test can observe.
+const observedServerFactory = (stopped: Ref.Ref<boolean>) =>
+  makeHttpServerFactory(() =>
+    Layer.merge(
+      NodeHttpServer.layerServer(createServer, { port: 0 }),
+      Layer.effectDiscard(Effect.addFinalizer(() => Ref.set(stopped, true)))
+    )
+  )
+
+const captureConsole = (lines: Array<string>): Console.Console =>
+  Object.assign(Object.create(console), {
+    log: (...args: ReadonlyArray<unknown>) => lines.push(args.join(" ")),
+    error: (...args: ReadonlyArray<unknown>) => lines.push(`stderr: ${args.join(" ")}`)
+  })
+
+const deliverCallback = (authUrl: string) =>
+  Effect.gen(function*() {
+    const url = new URL(authUrl)
+    const redirect = url.searchParams.get("redirect_uri") ?? ""
+    const state = url.searchParams.get("state") ?? ""
+    const port = new URL(redirect).port
+    const client = yield* HttpClient.HttpClient
+    yield* client.execute(
+      HttpClientRequest.get(`http://127.0.0.1:${port}/callback`).pipe(
+        HttpClientRequest.setUrlParam("code", "code-1"),
+        HttpClientRequest.setUrlParam("state", state)
+      )
+    )
+  }).pipe(Effect.provide(NodeHttpClient.layerUndici))
+
+describe("Atlassian CLI login", () => {
+  it.live("keeps waiting for the callback when no browser launcher succeeds", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedConfig
+      const launched = yield* Deferred.make<string>()
+      const attempts = yield* Ref.make<ReadonlyArray<string>>([])
+      const lines: Array<string> = []
+      const stopped = yield* Ref.make(false)
+
+      const login = yield* makeAtlassianCliAuth(authOptions).pipe(
+        Effect.flatMap((auth) => auth.login()),
+        Effect.provide(Layer.mergeAll(
+          NodeServices.layer,
+          HomeDirectoryLive,
+          atlassianClient,
+          failingLaunchers(launched, attempts),
+          observedServerFactory(stopped)
+        )),
+        Effect.provideService(Console.Console, captureConsole(lines)),
+        Effect.forkChild({ startImmediately: true })
+      )
+
+      const authUrl = yield* Deferred.await(launched)
+      yield* deliverCallback(authUrl)
+      const result = yield* Fiber.join(login)
+
+      expect(result).toBeUndefined()
+      expect(yield* Ref.get(attempts)).toEqual(["open", "xdg-open", "rundll32.exe"])
+      const printed = lines
+      expect(printed.some((line) => line.includes(`visit: ${authUrl}`))).toBe(true)
+      expect(printed).toContain("stderr: Could not open a browser (rundll32.exe exited 1); visit the URL above.")
+      expect(printed).toContain("Logged in as Ada (ada@example.com)")
+      expect(yield* Ref.get(stopped)).toBe(true)
+      const stored = yield* loadActiveProfileToken(TOOL).pipe(Effect.provide(storage))
+      expect(stored?.cloud_id).toBe("cloud-1")
+    })))
+
+  it.effect("fails before advertising a URL when the callback server cannot bind", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedConfig
+      const launched = yield* Deferred.make<string>()
+      const attempts = yield* Ref.make<ReadonlyArray<string>>([])
+      const lines: Array<string> = []
+      const refused = makeHttpServerFactory(() =>
+        Layer.effect(
+          HttpServer.HttpServer,
+          Effect.fail(new HttpServerError.ServeError({ cause: { code: "EACCES" } }))
+        )
+      )
+
+      const error = yield* makeAtlassianCliAuth(authOptions).pipe(
+        Effect.flatMap((auth) => auth.login()),
+        Effect.provide(
+          Layer.mergeAll(
+            NodeServices.layer,
+            HomeDirectoryLive,
+            atlassianClient,
+            failingLaunchers(launched, attempts),
+            refused
+          )
+        ),
+        Effect.provideService(Console.Console, captureConsole(lines)),
+        Effect.flip
+      )
+
+      expect(error._tag).toBe("OAuthError")
+      expect(yield* Ref.get(attempts)).toEqual([])
+      expect(lines).toEqual([])
+    })))
+
+  it.effect("stops the callback server when authorization times out", () =>
+    withHome(Effect.gen(function*() {
+      yield* seedConfig
+      const launched = yield* Deferred.make<string>()
+      const attempts = yield* Ref.make<ReadonlyArray<string>>([])
+      const lines: Array<string> = []
+      const stopped = yield* Ref.make(false)
+
+      const login = yield* makeAtlassianCliAuth(authOptions).pipe(
+        Effect.flatMap((auth) => auth.login()),
+        Effect.provide(Layer.mergeAll(
+          NodeServices.layer,
+          HomeDirectoryLive,
+          atlassianClient,
+          failingLaunchers(launched, attempts),
+          observedServerFactory(stopped)
+        )),
+        Effect.provideService(Console.Console, captureConsole(lines)),
+        Effect.flip,
+        Effect.forkChild({ startImmediately: true })
+      )
+
+      yield* Deferred.await(launched)
+      // The deadline is registered just after the launch; step the clock past it
+      // in increments so it fires wherever in that window it was set.
+      for (let minute = 0; minute < 10; minute++) {
+        yield* TestClock.adjust("1 minute")
+        yield* Effect.yieldNow
+      }
+      const error = yield* Fiber.join(login)
+
+      expect(error._tag).toBe("OAuthError")
+      expect(String(error.cause)).toBe("Authorization timed out")
+      expect(yield* Ref.get(stopped)).toBe(true)
+    })))
+  // With several sites, the login either lists them for the user to pick from
+  // or uses the one named by --site; an unknown --site fails and lists them.
+  const loginWithSites = (siteUrl: string | undefined) =>
+    Effect.gen(function*() {
+      yield* seedConfig
+      const launched = yield* Deferred.make<string>()
+      const attempts = yield* Ref.make<ReadonlyArray<string>>([])
+      const stopped = yield* Ref.make(false)
+      const lines: Array<string> = []
+      const login = yield* makeAtlassianCliAuth(authOptions).pipe(
+        Effect.flatMap((auth) => auth.login(siteUrl === undefined ? undefined : { siteUrl })),
+        Effect.provide(Layer.mergeAll(
+          NodeServices.layer,
+          HomeDirectoryLive,
+          atlassianClientWith([firstSite, secondSite]),
+          failingLaunchers(launched, attempts),
+          observedServerFactory(stopped)
+        )),
+        Effect.provideService(Console.Console, captureConsole(lines)),
+        Effect.result,
+        Effect.forkChild({ startImmediately: true })
+      )
+      yield* deliverCallback(yield* Deferred.await(launched))
+      const result = yield* Fiber.join(login)
+      const stored = yield* loadActiveProfileToken(TOOL).pipe(Effect.provide(storage))
+      return { result, stored }
+    })
+
+  it.live("lists the sites when several are available and none was chosen", () =>
+    withHome(Effect.gen(function*() {
+      const { result, stored } = yield* loginWithSites(undefined)
+      expect(result).toMatchObject({
+        success: [
+          { id: "cloud-1", name: "Site", url: "https://site.atlassian.net" },
+          { id: "cloud-2", name: "Other", url: "https://other.atlassian.net" }
+        ]
+      })
+      expect(stored).toBeNull()
+    })))
+
+  it.live("logs into the site chosen with --site", () =>
+    withHome(Effect.gen(function*() {
+      const { stored } = yield* loginWithSites("https://other.atlassian.net")
+      expect(stored?.cloud_id).toBe("cloud-2")
+    })))
+
+  it.live("fails and lists the sites when --site names none of them", () =>
+    withHome(Effect.gen(function*() {
+      const { result, stored } = yield* loginWithSites("https://missing.atlassian.net")
+      expect(result).toMatchObject({ failure: { _tag: "OAuthError", step: "authorize" } })
+      expect(String(result._tag === "Failure" ? result.failure.cause : "")).toContain("https://other.atlassian.net")
+      expect(stored).toBeNull()
+    })))
+})