1import { Auth } from "@alchemy.run/neon/Auth";
2import { AuthOAuthProvider } from "@alchemy.run/neon/AuthOAuthProvider";
3import { Project } from "@alchemy.run/neon/Project";
4import { providers } from "@alchemy.run/neon/Providers";
5import { expect } from "@alchemy.run/test";
6import * as Test from "@alchemy.run/test/Alchemy";
7import * as SDK from "@distilled.cloud/neon";
8import * as Effect from "effect/Effect";
9import * as Redacted from "effect/Redacted";
10
11const { test } = Test.make({ providers: providers() });
12
13test.provider(
14 "OAuth configuration owns one provider and never publishes its secret",
15 (stack) =>
16 Effect.gen(function* () {
17 yield* stack.destroy();
18 const application = (clientId: string | undefined) =>
19 Effect.gen(function* () {
20 const project = yield* Project("OAuthProject", {
21 region: "aws-us-east-2",
22 });
23 const auth = yield* Auth("OAuthAuth", { project });
24 const provider = yield* AuthOAuthProvider("GitHub", {
25 auth,
26 provider: "github",
27 clientId,
28 clientSecret: Redacted.make("alchemy-configuration-only-not-a-real-oauth-secret"),
29 });
30 return { auth, provider };
31 });
32 const first = yield* stack.deploy(application("alchemy-configuration-only"));
33 const request = {
34 project_id: first.auth.projectId,
35 branch_id: first.auth.branchId,
36 };
37 expect(
38 (yield* SDK.listBranchNeonAuthOauthProviders(request)).providers.find(
39 (item) => item.id === "github",
40 )?.client_id,
41 ).toBe("alchemy-configuration-only");
42 expect(Object.keys(first.provider)).not.toContain("clientSecret");
43 const updated = yield* stack.deploy(application("alchemy-configuration-updated"));
44 expect(updated.provider.provider).toBe("github");
45 expect(
46 (yield* SDK.listBranchNeonAuthOauthProviders(request)).providers.find(
47 (item) => item.id === "github",
48 )?.client_id,
49 ).toBe("alchemy-configuration-updated");
50 const refused = yield* stack.deploy(application(undefined)).pipe(
51 Effect.as(false),
52 Effect.catchTag("InvalidManagedAuth", () => Effect.succeed(true)),
53 );
54 expect(refused).toBe(true);
55 expect(
56 (yield* SDK.listBranchNeonAuthOauthProviders(request)).providers.find(
57 (item) => item.id === "github",
58 )?.client_id,
59 ).toBe("alchemy-configuration-updated");
60 yield* stack.destroy();
61 expect(
62 yield* SDK.getNeonAuth(request).pipe(
63 Effect.as(false),
64 Effect.catchTag("NotFound", () => Effect.succeed(true)),
65 ),
66 ).toBe(true);
67 yield* stack.destroy();
68 }),
69 {
70 tags: [
71 "provider:neon",
72 "provider:neon:auth",
73 "provider:neon:authoauthprovider",
74 "provider:neon:project",
75 "live",
76 ],
77 timeout: 120_000,
78 },
79);