(options: CloudBootOptions)
| 49 | } |
| 50 | |
| 51 | export const bootCloud = async (options: CloudBootOptions): Promise<CloudBooted> => { |
| 52 | // Fresh dev DB per boot — the WorkOS emulator mints org ids from a |
| 53 | // per-process counter, so a persisted DB from a previous invocation |
| 54 | // collides with the new boot's ids (identities land in polluted orgs / |
| 55 | // org creation 500s). |
| 56 | const dbPath = resolve(cloudDir, ".e2e-stub-db"); |
| 57 | if (options.fresh ?? true) rmSync(dbPath, { recursive: true, force: true }); |
| 58 | |
| 59 | // MCP access tokens minted by the emulator's OAuth server must carry the |
| 60 | // app's client id as audience (what the resource server verifies). |
| 61 | process.env.EMULATE_WORKOS_AUDIENCE = options.workosClientId; |
| 62 | const workos = await createEmulator({ |
| 63 | service: "workos", |
| 64 | port: options.workosPort, |
| 65 | ...(options.workosPublicUrl ? { baseUrl: options.workosPublicUrl } : {}), |
| 66 | }); |
| 67 | const autumn = await createEmulator({ |
| 68 | service: "autumn", |
| 69 | port: options.autumnPort, |
| 70 | // Seed the plan catalog so the billing UI (plans, eligibility, trial |
| 71 | // checkout) has real plans to render. Derived from autumn.config.ts. |
| 72 | seed: { autumn: { plans: AUTUMN_PLAN_SEED } }, |
| 73 | }); |
| 74 | |
| 75 | const workosUrl = options.workosPublicUrl ?? workos.url; |
| 76 | const env = { |
| 77 | // Real client, emulated service. The app derives the browser-facing |
| 78 | // authorize URL from WORKOS_API_URL, so it must be the PUBLIC origin. |
| 79 | WORKOS_API_URL: workosUrl, |
| 80 | AUTUMN_API_URL: autumn.url, |
| 81 | WORKOS_API_KEY: "sk_test_emulate", |
| 82 | WORKOS_CLIENT_ID: options.workosClientId, |
| 83 | WORKOS_COOKIE_PASSWORD: options.cookiePassword, |
| 84 | AUTUMN_SECRET_KEY: "am_test_emulate", |
| 85 | ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", |
| 86 | DATABASE_URL: `postgresql://postgres:postgres@127.0.0.1:${options.dbPort}/postgres`, |
| 87 | EXECUTOR_DIRECT_DATABASE_URL: "true", |
| 88 | CLOUDFLARE_INCLUDE_PROCESS_ENV: "true", |
| 89 | VITE_PUBLIC_SITE_URL: options.publicUrl, |
| 90 | // The AuthKit domain (MCP OAuth metadata + JWKS) is the emulator too. |
| 91 | MCP_AUTHKIT_DOMAIN: workosUrl, |
| 92 | MCP_RESOURCE_ORIGIN: options.publicUrl, |
| 93 | MCP_SESSION_TIMEOUT_MS: process.env.MCP_SESSION_TIMEOUT_MS, |
| 94 | MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS: process.env.MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS, |
| 95 | ALLOW_LOCAL_NETWORK: "true", |
| 96 | // A first-party GitHub app for the first-party-oauth scenario: proves the |
| 97 | // env → HostConfig → executor plumbing end to end. The scenario asserts the |
| 98 | // authorize REDIRECT only (client id + callback), never visits github.com. |
| 99 | FIRST_PARTY_GITHUB_CLIENT_ID: "e2e-first-party-github", |
| 100 | FIRST_PARTY_GITHUB_CLIENT_SECRET: "e2e-first-party-github-secret", |
| 101 | // Optional endpoint overrides pass through so a dev instance (`cli up |
| 102 | // cloud`) can point the first-party app at an emulated GitHub and run the |
| 103 | // complete authorize → token dance instead of stopping at github.com. |
| 104 | FIRST_PARTY_GITHUB_AUTHORIZE_URL: process.env.FIRST_PARTY_GITHUB_AUTHORIZE_URL, |
| 105 | FIRST_PARTY_GITHUB_TOKEN_URL: process.env.FIRST_PARTY_GITHUB_TOKEN_URL, |
| 106 | // Fake Google registration for redirect-only first-party coverage. The |
| 107 | // scenario never visits Google or exchanges a code; it proves cloud env, |
| 108 | // scope policy, and authorization URL construction end to end. |
no test coverage detected