(options: CloudBootOptions)
| 52 | } |
| 53 | |
| 54 | export const bootCloud = async (options: CloudBootOptions): Promise<CloudBooted> => { |
| 55 | // Fresh dev DB per boot — the WorkOS emulator mints org ids from a |
| 56 | // per-process counter, so a persisted DB from a previous invocation |
| 57 | // collides with the new boot's ids (identities land in polluted orgs / |
| 58 | // org creation 500s). |
| 59 | const dbPath = resolve(cloudDir, ".e2e-stub-db"); |
| 60 | if (options.fresh ?? true) rmSync(dbPath, { recursive: true, force: true }); |
| 61 | |
| 62 | // Fresh worker state per boot, for the same reason as the DB: miniflare |
| 63 | // persists the Workers Cache API under .wrangler/state across dev-server |
| 64 | // runs, and the JWKS L2 cache (auth/jwks-cache.ts) lives there keyed by |
| 65 | // URL. The WorkOS emulator binds this checkout's stable port block, so run |
| 66 | // N+1's dev server serves run N's cached JWKS (stale-while-revalidate) |
| 67 | // against a fresh emulator's keys — every session verify then fails |
| 68 | // signature, falls into single-use refresh, and concurrent requests race |
| 69 | // each other's rotation into 401s. One run poisons the next. |
| 70 | if (options.fresh ?? true) { |
| 71 | rmSync(resolve(cloudDir, ".wrangler", "state"), { recursive: true, force: true }); |
| 72 | } |
| 73 | |
| 74 | // MCP access tokens minted by the emulator's OAuth server must carry the |
| 75 | // app's client id as audience (what the resource server verifies). |
| 76 | process.env.EMULATE_WORKOS_AUDIENCE = options.workosClientId; |
| 77 | const workos = await createEmulator({ |
| 78 | service: "workos", |
| 79 | port: options.workosPort, |
| 80 | ...(options.workosPublicUrl ? { baseUrl: options.workosPublicUrl } : {}), |
| 81 | }); |
| 82 | const autumn = await createEmulator({ |
| 83 | service: "autumn", |
| 84 | port: options.autumnPort, |
| 85 | // Seed the plan catalog so the billing UI (plans, eligibility, trial |
| 86 | // checkout) has real plans to render. Derived from autumn.config.ts. |
| 87 | seed: { autumn: { plans: AUTUMN_PLAN_SEED } }, |
| 88 | }); |
| 89 | |
| 90 | const workosUrl = options.workosPublicUrl ?? workos.url; |
| 91 | const env = { |
| 92 | // Real client, emulated service. The app derives the browser-facing |
| 93 | // authorize URL from WORKOS_API_URL, so it must be the PUBLIC origin. |
| 94 | WORKOS_API_URL: workosUrl, |
| 95 | AUTUMN_API_URL: autumn.url, |
| 96 | WORKOS_API_KEY: "sk_test_emulate", |
| 97 | WORKOS_CLIENT_ID: options.workosClientId, |
| 98 | WORKOS_COOKIE_PASSWORD: options.cookiePassword, |
| 99 | AUTUMN_SECRET_KEY: "am_test_emulate", |
| 100 | ENCRYPTION_KEY: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", |
| 101 | DATABASE_URL: `postgresql://postgres:postgres@127.0.0.1:${options.dbPort}/postgres`, |
| 102 | EXECUTOR_DIRECT_DATABASE_URL: "true", |
| 103 | CLOUDFLARE_INCLUDE_PROCESS_ENV: "true", |
| 104 | VITE_PUBLIC_SITE_URL: options.publicUrl, |
| 105 | // The AuthKit domain (MCP OAuth metadata + JWKS) is the emulator too. |
| 106 | MCP_AUTHKIT_DOMAIN: workosUrl, |
| 107 | MCP_RESOURCE_ORIGIN: options.publicUrl, |
| 108 | MCP_SESSION_TIMEOUT_MS: process.env.MCP_SESSION_TIMEOUT_MS, |
| 109 | MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS: process.env.MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS, |
| 110 | ALLOW_LOCAL_NETWORK: "true", |
| 111 | // A first-party GitHub app for the first-party-oauth scenario: proves the |
no test coverage detected