[Bug]: Copied 1Password references with edge spaces are rewritten or rejected #35931

import { readFileSync, writeFileSync, mkdtempSync, rmSync } from "node:fs";
import { join, resolve, dirname } from "node:path";
import { tmpdir } from "node:os";
import { pathToFileURL } from "node:url";
import { createRequire, stripTypeScriptTypes } from "node:module";
import { execFileSync, spawn } from "node:child_process";
import { createServer } from "node:http";
import { once } from "node:events";
import { mkdirSync } from "node:fs";

const checkout = resolve(process.argv[2] ?? ".");
let scratch;
let result = 2;
try {
  console.log(`node ${process.version}`);
  console.log(execFileSync("git", ["--version"], { encoding: "utf8" }).trim());
  console.log(`commit ${execFileSync("git", ["-C", checkout, "rev-parse", "HEAD"], { encoding: "utf8" }).trim()}`);
  const require = createRequire(join(checkout, "packages/contracts/package.json"));
  const effectManifest = require.resolve("effect/package.json");
  console.log(`effect ${JSON.parse(readFileSync(effectManifest, "utf8")).version}`);
  scratch = mkdtempSync(join(tmpdir(), "reference-repro-"));
  process.env.HOME = scratch;
  process.env.TMPDIR = scratch;
  process.env.T3CODE_HOME = scratch;
  const effectImport = (specifier) => pathToFileURL(require.resolve(specifier)).href;
  const copy = (name, relative, replacements = []) => {
    let source = readFileSync(join(checkout, relative), "utf8");
    for (const [before, after] of replacements) source = source.replace(before, after);
    source = stripTypeScriptTypes(source);
    source = source.replace(/from "(effect\/[^"\n]+)"/g, (_, specifier) => `from "${effectImport(specifier)}"`);
    const destination = join(scratch, name);
    writeFileSync(destination, source);
    return pathToFileURL(destination).href;
  };
  copy("baseSchemas.mjs", "packages/contracts/src/baseSchemas.ts");
  copy("secretReference.mjs", "packages/contracts/src/secretReference.ts", [['"./baseSchemas.ts"', '"./baseSchemas.mjs"']]);
  copy("definitionCore.mjs", "packages/secret-provider-core/src/shared/definition.ts");
  const settings = readFileSync(join(checkout, "packages/contracts/src/settings.ts"), "utf8");
  const kind = settings.match(/^export const SecretProviderKind = .*;$/m)?.[0];
  if (!kind) throw new Error("Cannot find provider-kind schema");
  writeFileSync(join(scratch, "contracts.mjs"), `import * as Schema from "${effectImport("effect/Schema")}";\nimport { SecretProviderSlug } from "./secretReference.mjs";\n${kind}\n`);
  const definitionURL = copy("definition.mjs", "packages/secret-provider-onepassword/src/shared/definition.ts", [
    ['"@t3tools/contracts"', '"./contracts.mjs"'],
    ['"@t3tools/secret-provider-core/shared/definition"', '"./definitionCore.mjs"'],
  ]);
  const Schema = await import(effectImport("effect/Schema"));
  const { SecretReference } = await import(pathToFileURL(join(scratch, "secretReference.mjs")).href);
  const { definition } = await import(definitionURL);
  const decodes = (reference) => Schema.is(SecretReference)({ provider: "op", reference });
  mkdirSync(join(scratch, "op-config"), { mode: 0o700 });
  const vault = "a".repeat(26);
  const item = "b".repeat(26);
  const fixture = {
    id: item, title: "item", vault: { id: vault }, category: "API_CREDENTIAL", version: 1,
    fields: [
      { id: "plain", type: "STRING", label: "credential", value: "PLAIN" },
      { id: "trailing", type: "STRING", label: "credential ", value: "TRAILING" },
      { id: "leading", type: "STRING", label: " credential", value: "LEADING" },
    ],
  };
  const server = createServer((request, response) => {
    const path = new URL(request.url, "http://127.0.0.1").pathname;
    let data;
    if (path === "/v1/vaults") data = [{ id: vault, name: "vault" }];
    else if (path === `/v1/vaults/${vault}`) data = { id: vault, name: "vault" };
    else if (path === `/v1/vaults/${vault}/items`) data = [fixture];
    else if (path === `/v1/vaults/${vault}/items/${item}`) data = fixture;
    else { response.writeHead(404).end(); return; }
    response.writeHead(200, { "Content-Type": "application/json" }).end(JSON.stringify(data));
  });
  server.listen(0, "127.0.0.1");
  await once(server, "listening");
  const env = {
    PATH: process.env.PATH, HOME: scratch, TMPDIR: scratch, T3CODE_HOME: scratch,
    OP_CONFIG_DIR: join(scratch, "op-config"), OP_BIOMETRIC_UNLOCK_ENABLED: "false",
    OP_CONNECT_HOST: `http://127.0.0.1:${server.address().port}`, OP_CONNECT_TOKEN: "fixture",
  };
  const op = async (args) => {
    const child = spawn("op", args, { env, stdio: ["ignore", "pipe", "pipe"], timeout: 10000 });
    let stdout = "";
    let stderr = "";
    child.stdout.setEncoding("utf8").on("data", (chunk) => { stdout += chunk; });
    child.stderr.setEncoding("utf8").on("data", (chunk) => { stderr += chunk; });
    const [code] = await once(child, "close");
    if (code !== 0) throw new Error(`op failed with status ${code}`);
    return stdout;
  };
  let failures = 0;
  try {
    console.log(`op ${(await op(["--version"])).trim()}`);
    const fetched = JSON.parse(await op(["--cache=false", "item", "get", item, "--vault", vault, "--format", "json"]));
    const decode = Schema.decodeUnknownSync(SecretReference);
    const read = (reference) => op(["--cache=false", "read", "--account=fixture", "--no-newline", reference]);
    const plain = fetched.fields.find((field) => field.id === "plain").reference;
    if (!definition.isReference(plain) || await read(plain) !== "PLAIN") throw new Error("plain reference control failed");
    console.log("plain-reference control: PLAIN");
    for (const [id, expected] of [["trailing", "TRAILING"], ["leading", "LEADING"]]) {
      const reference = fetched.fields.find((field) => field.id === id).reference;
      const originalValue = await read(reference);
      if (originalValue !== expected) throw new Error("direct reference control failed");
      const decoded = decode({ provider: "op", reference }).reference;
      const accepted = definition.isReference(decoded);
      const actual = accepted ? await read(decoded) : "REJECTED";
      console.log(`${id} copied reference: ${JSON.stringify(reference)}`);
      console.log(`${id}: direct=${originalValue}, normalized=${decoded !== reference}, accepted=${accepted}, after-input=${actual}`);
      if (!accepted || decoded !== reference || actual !== expected) failures++;
      const byId = `op://${vault}/item/${id}`;
      if (!definition.isReference(byId) || await read(byId) !== expected) throw new Error("ID workaround control failed");
      console.log(`${id} ID workaround: ${expected}`);
    }
    result = failures === 0 ? 0 : 1;
  } finally {
    await new Promise((done) => server.close(done));
    server.closeAllConnections();
  }
} catch (error) {
  console.log(`setup: ${error instanceof Error ? error.message.replaceAll(checkout, "<checkout>") : "unknown error"}`);
} finally {
  if (scratch) rmSync(scratch, { recursive: true, force: true });
}
console.log(result === 0 ? "RESULT: expected behavior" : result === 1 ? "RESULT: defect reproduced" : "RESULT: inconclusive");
process.exitCode = result;