Function singleSignOn

e2e/selfhost/mcp-enterprise-managed-auth.test.ts:103–145

(input: {
  readonly issuerBaseUrl: string;
  readonly clientId: string;
  readonly clientSecret: string;
})

 *  the profile leaves "where the identity assertion comes from" to the host,
 *  and executor is handed the result on the connect request. */
const singleSignOn = (input: {
  readonly issuerBaseUrl: string;
  readonly clientId: string;
  readonly clientSecret: string;
}) =>
  Effect.promise(async (): Promise<string> => {
    const authorize = await fetch(
      `${input.issuerBaseUrl}/oauth2/${OKTA_AUTH_SERVER}/v1/authorize/callback`,
      {
        method: "POST",
        headers: { "content-type": "application/x-www-form-urlencoded" },
        redirect: "manual",
        body: new URLSearchParams({
          user_ref: OKTA_USER,
          redirect_uri: SSO_REDIRECT_URI,
          scope: "openid profile email",
          client_id: input.clientId,
          response_mode: "query",
          auth_server_id: OKTA_AUTH_SERVER,
        }),
      },
    );
    if (authorize.status !== 302) {
      throw new Error(`IdP authorize answered ${authorize.status}, expected a 302`);
    }
    const location = requireString(authorize.headers.get("location"), "authorize redirect");
    const code = requireString(new URL(location).searchParams.get("code"), "authorization code");

    const token = await fetch(`${input.issuerBaseUrl}/oauth2/${OKTA_AUTH_SERVER}/v1/token`, {
      method: "POST",
      headers: { "content-type": "application/x-www-form-urlencoded" },
      body: new URLSearchParams({
        grant_type: "authorization_code",
        code,
        redirect_uri: SSO_REDIRECT_URI,
        client_id: input.clientId,
        client_secret: input.clientSecret,
      }),
    });
    if (!token.ok) throw new Error(`IdP token endpoint answered ${token.status}`);
    const body = (await token.json()) as { readonly id_token?: string };
    return requireString(body.id_token, "id_token");
  });

const ledger = (instance: Emulator) => Effect.promise(() => instance.ledger.list());