dify/cli/test/e2e/suites/auth/use.e2e.ts

/**
 * E2E: difyctl use workspace — Workspace switching
 *
 * Test cases sourced from: Dify CLI Enhanced spec — Dify CLI/Auth/Workspace Switching (22 wiki cases → 19 automated)
 */

import type { RunResult } from '../../helpers/cli.js'
import { join } from 'node:path'
import { afterEach, beforeEach, describe, expect, inject, it } from 'vitest'
import { assertExitCode } from '../../helpers/assert.js'
import { injectAuth, injectSsoAuth, run, withTempConfig } from '../../helpers/cli.js'
import { withRetry } from '../../helpers/retry.js'
import { resolveEnv } from '../../setup/env.js'

// @ts-expect-error — see test/e2e/helpers/vitest-context.ts for explanation
const caps = inject('e2eCapabilities') as import('../../setup/env.js').E2ECapabilities
const E = resolveEnv(caps)

// Secondary workspace used in tests — injected into available_workspaces
const WS2_ID = '00000000-e2e2-0000-0001-000000000002'
const WS2_NAME = 'Secondary Workspace'

describe('E2E / difyctl use workspace', () => {
  let configDir: string
  let cleanup: () => Promise<void>

  beforeEach(async () => {
    const tmp = await withTempConfig()
    configDir = tmp.configDir
    cleanup = tmp.cleanup
  })
  afterEach(async () => {
    await cleanup()
  })

  function r(argv: string[]) {
    return run(argv, { configDir })
  }

  function isServer5xx(result: RunResult): boolean {
    return result.exitCode !== 0 && /server_5xx|HTTP 5\d\d/i.test(result.stderr)
  }

  async function switchWorkspace(workspaceId: string): Promise<RunResult | undefined> {
    try {
      return await withRetry(async () => {
        const result = await r(['use', 'workspace', workspaceId])
        if (isServer5xx(result))
          throw new Error(result.stderr)
        return result
      }, {
        attempts: 3,
        delayMs: 1_000,
        shouldRetry: err => /server_5xx|HTTP 5\d\d/i.test(String(err)),
      })
    }
    catch (err) {
      if (/server_5xx|HTTP 5\d\d/i.test(String(err))) {
        console.warn(`[E2E] workspace switch ${workspaceId} returned persistent server_5xx; skipping server-dependent assertion.`)
        return undefined
      }
      throw err
    }
  }

  /** Inject a bundle with two workspaces. */
  async function withTwoWorkspaces() {
    await injectAuth(configDir, {
      host: E.host,
      bearer: E.token,
      email: E.email,
      workspaceId: E.workspaceId,
      workspaceName: E.workspaceName,
      availableWorkspaces: [
        { id: E.workspaceId, name: E.workspaceName, role: 'owner' },
        { id: E.ws2Id || WS2_ID, name: WS2_NAME, role: 'normal' },
      ],
    })
  }

  async function withSSOAuth() {
    await injectSsoAuth(configDir, {
      host: E.host,
      bearer: E.ssoToken || 'dfoe_sso_test',
      email: 'sso@example.com',
      issuer: 'https://issuer.example.com',
    })
  }

  // ── Normal workspace switch ──────────────────────────────────────────────────

  it('[P0] internal user can switch to a specified workspace', async () => {
    // Spec: internal user can switch to a specified workspace
    // use E.workspaceId (real server id); WS2_ID is synthetic and not on server
    await withTwoWorkspaces()
    const result = await switchWorkspace(E.workspaceId)
    if (result === undefined)
      return
    assertExitCode(result, 0)
    expect(result.stdout).toMatch(/switched|workspace/i)
    expect(result.stdout).toContain(E.workspaceId)
  })

  it('[P0] auth status shows the new workspace after auth use', async () => {
    // Spec: auth status shows new workspace after auth use
    await withTwoWorkspaces()
    const switchResult = await switchWorkspace(E.workspaceId)
    if (switchResult === undefined)
      return
    assertExitCode(switchResult, 0)
    const hostsContent = await (await import('node:fs/promises')).readFile(
      join(configDir, 'hosts.yml'),
      'utf8',
    )
    expect(hostsContent).toContain(E.workspaceId)
  })

  it('[P0] auth use updates current_workspace_id (hosts.yml is updated)', async () => {
    // Spec: auth use updates current_workspace_id
    // Switch to primary workspace (real server id); verify hosts.yml is updated
    await withTwoWorkspaces()
    const switchResult = await switchWorkspace(E.workspaceId)
    if (switchResult === undefined)
      return
    assertExitCode(switchResult, 0)
    const { readFile } = await import('node:fs/promises')
    const hostsContent = await readFile(join(configDir, 'hosts.yml'), 'utf8')
    expect(hostsContent).toContain(E.workspaceId)
  })

  it('[P1] switching to the same workspace repeatedly is idempotent', async () => {
    // Spec: switching to the same workspace is idempotent
    await withTwoWorkspaces()
    const r1 = await switchWorkspace(E.workspaceId)
    if (r1 === undefined)
      return
    assertExitCode(r1, 0)
    const r2 = await switchWorkspace(E.workspaceId)
    if (r2 === undefined)
      return
    assertExitCode(r2, 0)
  })

  // ── Error scenarios ──────────────────────────────────────────────────────────

  it('[P0] switching to a non-existent workspace returns an error', async () => {
    // Spec: switching to a non-existent workspace returns an error
    await withTwoWorkspaces()
    const result = await r(['auth', 'use', 'ffffffff-dead-0000-0000-000000000000'])
    expect(result.exitCode).not.toBe(0)
    expect(result.stderr).toMatch(/server_5xx|not found|workspace|error/i)
  })

  it('[P0] current_workspace_id is unchanged when workspace switch fails', async () => {
    // Spec: current_workspace_id is unchanged when workspace switch fails
    await withTwoWorkspaces()
    await r(['auth', 'use', 'ffffffff-dead-0000-0000-000000000000'])
    // Read hosts.yml directly; the original workspace id should still be present
    const { readFile } = await import('node:fs/promises')
    const { join } = await import('node:path')
    const hostsContent = await readFile(join(configDir, 'hosts.yml'), 'utf8')
    expect(hostsContent).toContain(E.workspaceId)
  })

  it('[P0] unauthenticated auth use returns auth error (exit code 4)', async () => {
    // Spec: unauthenticated auth use returns auth error + exit code 4
    const result = await r(['use', 'workspace', E.workspaceId])
    assertExitCode(result, 4)
    expect(result.stderr).toMatch(/not.?logged.?in|auth.?login/i)
  })

  it('[P0] missing workspace argument returns a usage error', async () => {
    // Spec: missing workspace argument returns a usage error
    await withTwoWorkspaces()
    const result = await r(['use', 'workspace'])
    expect(result.exitCode).not.toBe(0)
    expect(result.stderr).toMatch(/missing|required|arg|usage|workspace/i)
  })

  // ── External SSO user ────────────────────────────────────────────────────────

  it('[P0] external SSO user is rejected when executing auth use', async () => {
    // Spec: external SSO user is rejected when executing auth use
    await withSSOAuth()
    const result = await r(['use', 'workspace', 'any-ws-id'])
    expect(result.exitCode).not.toBe(0)
    // SSO token rejected by server — error may be server_5xx or auth-related
    expect(result.stderr.trim().length).toBeGreaterThan(0)
  })

  it('[P1] external SSO user auth use exit code is 1 or 2', async () => {
    // Spec: external SSO user auth use exit code is 1
    await withSSOAuth()
    const result = await r(['use', 'workspace', 'any-ws-id'])
    expect([1, 2]).toContain(result.exitCode)
  })

  // ── Post-switch get app ──────────────────────────────────────────────────────
})