Function signIn

apps/cloud/src/auth/mirror-feeders.node.test.ts:220–263

(user: ReturnType<typeof workosUser>, listed: readonly FakeMembership[])

   * is assertable from the outside.
   */
  const signIn = (user: ReturnType<typeof workosUser>, listed: readonly FakeMembership[]) => {
    const calls: string[] = [];
    const refreshedInto: (string | undefined)[] = [];
    const handler = callbackHandler(
      stubWorkOS({
        authenticateWithCode: () =>
          Effect.succeed({
            user,
            organizationId: undefined,
            accessToken: "access",
            refreshToken: "refresh",
            sealedSession: "sealed",
          }),
        listUserMemberships: (id) => {
          calls.push(`listUserMemberships:${id}`);
          return Effect.succeed({
            object: "list" as const,
            data: listed as never[],
            listMetadata: { before: null, after: null },
          });
        },
        // The landing org's seat recount scans the org from WorkOS the first
        // time it is counted (its per-org backfill mark is missing); the
        // scan lists the org's members and fetches each user.
        listOrgMembers: (organizationId) => {
          calls.push(`listOrgMembers:${organizationId}`);
          return Effect.succeed({
            object: "list" as const,
            data: listed.filter((m) => m.organizationId === organizationId) as never[],
            listMetadata: { before: null, after: null },
          });
        },
        getUser: (id) => {
          calls.push(`getUser:${id}`);
          return Effect.succeed(workosUser(id) as never);
        },
        refreshSession: (_sealed, organizationId) => {
          refreshedInto.push(organizationId);
          return Effect.succeed("sealed-refreshed");
        },
      }),
    );
    return { handler, calls, refreshedInto };
  };

  /**
   * `GET /auth/callback` with the CSRF-matched login `state` (the callback