@antelopejs/dms 0.0.1

package/dist/test/unit/oauth-relay.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-relay.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-relay.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,+BAA8B;AAC9B,yDAGuC;AAEvC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,SAAS,aAAa,CAAC,GAAkB;IACvC,IAAI,CAAC;QACH,GAAG,EAAE,CAAC;IACR,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAE,KAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACtE,IAAA,aAAM,EAAE,KAAoB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAC9C,4BAA4B,CAC7B,CAAC;QACF,OAAO;IACT,CAAC;IACD,aAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;AACpD,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,IAAA,aAAM,EAAC,IAAA,8BAAsB,GAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAA,8BAAsB,GAAE,CAAC,CAAC;QACpE,IAAA,aAAM,EAAC,IAAA,8BAAsB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,IAAA,aAAM,EAAC,GAAG,EAAE,CAAC,IAAA,wBAAgB,EAAC,IAAA,8BAAsB,GAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,aAAa,CAAC,GAAG,EAAE,CAAC,IAAA,wBAAgB,EAAC,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,aAAa,CAAC,GAAG,EAAE,CAAC,IAAA,wBAAgB,EAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,aAAa,CAAC,GAAG,EAAE,CAAC,IAAA,wBAAgB,EAAC,sBAAsB,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,IAAA,aAAM,EAAC,IAAA,8BAAsB,GAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-state.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/oauth-state.test.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const chai_1 = require("chai");
+const jsonwebtoken_1 = require("jsonwebtoken");
+const index_1 = require("../../index");
+const state_1 = require("../../routes/auth/oauth/state");
+const HTTP_BAD_REQUEST = 400;
+const INVALID_STATE_MESSAGE = "error.oauth.invalid_state";
+function expectRejection(run) {
+    try {
+        run();
+    }
+    catch (error) {
+        (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
+        (0, chai_1.expect)(error.getStatus()).to.equal(HTTP_BAD_REQUEST);
+        (0, chai_1.expect)(error.getBody()).to.equal(INVALID_STATE_MESSAGE);
+        return;
+    }
+    chai_1.expect.fail("expected the state to be rejected");
+}
+describe("[unit] oauth state", () => {
+    it("accepts the state the browser handed back untouched", () => {
+        const state = (0, state_1.signOAuthState)("github");
+        (0, chai_1.expect)(() => (0, state_1.assertValidOAuthState)(state, state, "github")).to.not.throw();
+    });
+    it("mints a distinct state per flow", () => {
+        (0, chai_1.expect)((0, state_1.signOAuthState)("github")).to.not.equal((0, state_1.signOAuthState)("github"));
+    });
+    it("consumes the state: the same state cannot complete two logins", () => {
+        const state = (0, state_1.signOAuthState)("github");
+        (0, state_1.assertValidOAuthState)(state, state, "github");
+        expectRejection(() => (0, state_1.assertValidOAuthState)(state, state, "github"));
+    });
+    it("rejects a state the browser never stored", () => {
+        const state = (0, state_1.signOAuthState)("github");
+        const otherState = (0, state_1.signOAuthState)("github");
+        expectRejection(() => (0, state_1.assertValidOAuthState)(state, otherState, "github"));
+    });
+    it("rejects a missing browser state", () => {
+        const state = (0, state_1.signOAuthState)("github");
+        expectRejection(() => (0, state_1.assertValidOAuthState)(state, "", "github"));
+    });
+    it("rejects a state minted for another provider", () => {
+        const state = (0, state_1.signOAuthState)("google");
+        expectRejection(() => (0, state_1.assertValidOAuthState)(state, state, "github"));
+    });
+    it("rejects a tampered state", () => {
+        const state = `${(0, state_1.signOAuthState)("github")}tampered`;
+        expectRejection(() => (0, state_1.assertValidOAuthState)(state, state, "github"));
+    });
+    it("rejects a state signed with the plain instance secret", () => {
+        const forged = (0, jsonwebtoken_1.sign)({ provider: "github", nonce: "1", purpose: "oauth-state" }, (0, index_1.getAuthConfig)().jwtSecret);
+        expectRejection(() => (0, state_1.assertValidOAuthState)(forged, forged, "github"));
+    });
+    it("rejects a token signed for another purpose", () => {
+        const forged = (0, jsonwebtoken_1.sign)({ provider: "github", nonce: "1", purpose: "2fa" }, `oauth-state:${(0, index_1.getAuthConfig)().jwtSecret}`);
+        expectRejection(() => (0, state_1.assertValidOAuthState)(forged, forged, "github"));
+    });
+});
+//# sourceMappingURL=oauth-state.test.js.map

package/dist/test/unit/oauth-state.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-state.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,+BAA8B;AAC9B,+CAAoC;AACpC,uCAA4C;AAC5C,yDAGuC;AAEvC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAE1D,SAAS,eAAe,CAAC,GAAkB;IACzC,IAAI,CAAC;QACH,GAAG,EAAE,CAAC;IACR,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAE,KAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrE,IAAA,aAAM,EAAE,KAAoB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,aAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;AACnD,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,IAAA,aAAM,EAAC,GAAG,EAAE,CAAC,IAAA,6BAAqB,EAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,IAAA,aAAM,EAAC,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,IAAA,6BAAqB,EAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC9C,eAAe,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAqB,EAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QAC5C,eAAe,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAqB,EAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAqB,EAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,CAAC;QACvC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAqB,EAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,KAAK,GAAG,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,UAAU,CAAC;QACpD,eAAe,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAqB,EAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,IAAA,mBAAI,EACjB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,EAC1D,IAAA,qBAAa,GAAE,CAAC,SAAS,CAC1B,CAAC;QACF,eAAe,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAqB,EAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,MAAM,GAAG,IAAA,mBAAI,EACjB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAClD,eAAe,IAAA,qBAAa,GAAE,CAAC,SAAS,EAAE,CAC3C,CAAC;QACF,eAAe,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAqB,EAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/request-authenticators.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/request-authenticators.test.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const chai_1 = require("chai");
+const request_tenant_1 = require("@antelopejs/interface-dms/request-tenant");
+const request_authenticators_1 = require("@antelopejs/interface-dms/auth/request-authenticators");
+const UNAUTHORIZED = 401;
+const TENANT = "credential-tenant";
+const USER_ID = "credential-user";
+function context(authorization = "Bearer opaque.secret") {
+    return { rawRequest: { headers: { authorization } } };
+}
+function principal(tenantId = TENANT, userId = USER_ID) {
+    return { tenantId, user: { _id: userId } };
+}
+function handler(authenticate = async () => principal()) {
+    return { recognizes: (token) => token.startsWith("opaque."), authenticate };
+}
+async function expectUnauthorized(action) {
+    try {
+        await action();
+        chai_1.expect.fail("Expected authentication failure");
+    }
+    catch (error) {
+        (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
+        (0, chai_1.expect)(error.getStatus()).to.equal(UNAUTHORIZED);
+    }
+}
+describe("[unit] request authenticators", () => {
+    let jwtCalls = 0;
+    const jwt = async () => {
+        jwtCalls++;
+        return principal("jwt-tenant");
+    };
+    beforeEach(() => {
+        jwtCalls = 0;
+    });
+    it("binds tenant to the verified credential across context wrappers", async () => {
+        const ctx = context();
+        const result = await (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [handler()], jwt);
+        result.tenantId = "tampered";
+        (0, chai_1.expect)((0, request_tenant_1.getRequestTenantId)({ ...ctx })).to.equal(TENANT);
+        (0, chai_1.expect)(jwtCalls).to.equal(0);
+    });
+    it("uses JWT only when no handler recognizes the credential", async () => {
+        const ctx = context("Bearer jwt");
+        await (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [handler()], jwt);
+        (0, chai_1.expect)((0, request_tenant_1.getRequestTenantId)(ctx)).to.equal("jwt-tenant");
+        (0, chai_1.expect)(jwtCalls).to.equal(1);
+    });
+    it("serializes concurrent validations without caching their result", async () => {
+        const ctx = context();
+        let attempts = 0;
+        const candidate = handler(async () => {
+            attempts++;
+            return principal();
+        });
+        await Promise.all([
+            (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [candidate], jwt),
+            (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [candidate], jwt),
+        ]);
+        (0, chai_1.expect)(attempts).to.equal(2);
+        (0, chai_1.expect)((0, request_tenant_1.getRequestTenantId)(ctx)).to.equal(TENANT);
+    });
+    it("propagates a concurrent recognized failure without JWT downgrade", async () => {
+        const ctx = context();
+        const candidate = handler(async () => {
+            throw new interface_api_1.HTTPResult(UNAUTHORIZED);
+        });
+        await Promise.all([
+            expectUnauthorized(() => (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [candidate], jwt)),
+            expectUnauthorized(() => (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [], jwt)),
+        ]);
+        (0, chai_1.expect)(jwtCalls).to.equal(0);
+        (0, chai_1.expect)(() => (0, request_tenant_1.getRequestTenantId)(ctx)).to.throw();
+    });
+    it("never falls back after recognized malformed, revoked or failed credentials", async () => {
+        const ctx = context("Bearer opaque.malformed");
+        const rejected = handler(async () => {
+            throw new interface_api_1.HTTPResult(UNAUTHORIZED);
+        });
+        await expectUnauthorized(() => (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [rejected], jwt));
+        (0, chai_1.expect)(() => (0, request_tenant_1.getRequestTenantId)(ctx)).to.throw();
+        await expectUnauthorized(() => (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [], jwt));
+        (0, chai_1.expect)(jwtCalls).to.equal(0);
+    });
+    it("rejects ambiguous handlers without attempting either authentication", async () => {
+        let attempts = 0;
+        const candidate = handler(async () => {
+            attempts++;
+            return principal();
+        });
+        await expectUnauthorized(() => (0, request_authenticators_1.resolveRequestPrincipal)(context(), [candidate, candidate], jwt));
+        (0, chai_1.expect)(attempts).to.equal(0);
+        (0, chai_1.expect)(jwtCalls).to.equal(0);
+    });
+    for (const authorization of [
+        "",
+        "Basic opaque.secret",
+        "Bearer opaque.secret extra",
+    ]) {
+        it(`rejects malformed authorization: ${authorization}`, async () => {
+            await expectUnauthorized(() => (0, request_authenticators_1.resolveRequestPrincipal)(context(authorization), [handler()], jwt));
+            (0, chai_1.expect)(jwtCalls).to.equal(0);
+        });
+    }
+    it("rejects a missing authenticated tenant rather than selecting the default tenant", async () => {
+        const ctx = context();
+        await expectUnauthorized(() => (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [handler(async () => principal(""))], jwt));
+        (0, chai_1.expect)(() => (0, request_tenant_1.getRequestTenantId)(ctx)).to.throw();
+    });
+    it("revalidates long-lived requests and makes revocation terminal", async () => {
+        const ctx = context();
+        let revoked = false;
+        let attempts = 0;
+        const candidate = handler(async () => {
+            attempts++;
+            if (revoked)
+                throw new interface_api_1.HTTPResult(UNAUTHORIZED);
+            return principal();
+        });
+        await (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [candidate], jwt);
+        await (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [candidate], jwt);
+        revoked = true;
+        await expectUnauthorized(() => (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [candidate], jwt));
+        (0, chai_1.expect)(attempts).to.equal(3);
+        (0, chai_1.expect)(() => (0, request_tenant_1.getRequestTenantId)(ctx)).to.throw();
+        (0, chai_1.expect)(jwtCalls).to.equal(0);
+    });
+    for (const changed of [
+        principal("other-tenant"),
+        principal(TENANT, "other-user"),
+    ]) {
+        it(`rejects principal reassignment to ${changed.tenantId}/${changed.user._id}`, async () => {
+            const ctx = context();
+            await (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [handler()], jwt);
+            await expectUnauthorized(() => (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [handler(async () => changed)], jwt));
+            (0, chai_1.expect)(() => (0, request_tenant_1.getRequestTenantId)(ctx)).to.throw();
+        });
+    }
+    it("does not reuse another request's identity or a changed header", async () => {
+        const ctx = context();
+        await (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [handler()], jwt);
+        const unrelated = context("Bearer jwt");
+        await (0, request_authenticators_1.resolveRequestPrincipal)(unrelated, [], jwt);
+        (0, chai_1.expect)((0, request_tenant_1.getRequestTenantId)(unrelated)).to.equal("jwt-tenant");
+        ctx.rawRequest.headers.authorization = "Bearer jwt";
+        (0, chai_1.expect)(() => (0, request_tenant_1.getRequestTenantId)(ctx)).to.throw();
+        await expectUnauthorized(() => (0, request_authenticators_1.resolveRequestPrincipal)(ctx, [], jwt));
+        (0, chai_1.expect)(jwtCalls).to.equal(1);
+    });
+});
+//# sourceMappingURL=request-authenticators.test.js.map

package/dist/test/unit/request-authenticators.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-authenticators.test.js","sourceRoot":"","sources":["../../../src/test/unit/request-authenticators.test.ts"],"names":[],"mappings":";;AACA,6DAAuD;AACvD,+BAA8B;AAC9B,6EAA8E;AAE9E,kGAI+D;AAE/D,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,MAAM,GAAG,mBAAmB,CAAC;AACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAElC,SAAS,OAAO,CAAC,aAAa,GAAG,sBAAsB;IACrD,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,EAAoB,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,QAAQ,GAAG,MAAM,EAAE,MAAM,GAAG,OAAO;IACpD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAU,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,OAAO,CAAC,YAAY,GAAG,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE;IACrD,OAAO,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;QACf,aAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAE,KAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE;QACrB,QAAQ,EAAE,CAAC;QACX,OAAO,SAAS,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,UAAU,CAAC,GAAG,EAAE;QACd,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC;QAC7B,IAAA,aAAM,EAAC,IAAA,mCAAkB,EAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACrD,IAAA,aAAM,EAAC,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE;YACnC,QAAQ,EAAE,CAAC;YACX,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC;YAC9C,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC;SAC/C,CAAC,CAAC;QACH,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAA,aAAM,EAAC,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,IAAI,0BAAU,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YACxE,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAA,gDAAuB,EAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;SAChE,CAAC,CAAC;QACH,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAA,aAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,GAAG,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE;YAClC,MAAM,IAAI,0BAAU,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC5B,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAC9C,CAAC;QACF,IAAA,aAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAA,gDAAuB,EAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACtE,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE;YACnC,QAAQ,EAAE,CAAC;YACX,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC5B,IAAA,gDAAuB,EAAC,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAChE,CAAC;QACF,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,aAAa,IAAI;QAC1B,EAAE;QACF,qBAAqB;QACrB,4BAA4B;KAC7B,EAAE,CAAC;QACF,EAAE,CAAC,oCAAoC,aAAa,EAAE,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC5B,IAAA,gDAAuB,EAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAClE,CAAC;YACF,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC5B,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CACxE,CAAC;QACF,IAAA,aAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE;YACnC,QAAQ,EAAE,CAAC;YACX,IAAI,OAAO;gBAAE,MAAM,IAAI,0BAAU,CAAC,YAAY,CAAC,CAAC;YAChD,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC5B,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAC/C,CAAC;QACF,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAA,aAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACjD,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,OAAO,IAAI;QACpB,SAAS,CAAC,cAAc,CAAC;QACzB,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC;KAChC,EAAE,CAAC;QACF,EAAE,CAAC,qCAAqC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,IAAI,EAAE;YACzF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;YACtB,MAAM,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC5B,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAClE,CAAC;YACF,IAAA,aAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,IAAA,gDAAuB,EAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,IAAA,gDAAuB,EAAC,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,IAAA,aAAM,EAAC,IAAA,mCAAkB,EAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7D,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC;QACpD,IAAA,aAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAA,gDAAuB,EAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACtE,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/request-tenant-guards.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/request-tenant-guards.test.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const chai_1 = require("chai");
+const dms_auth_1 = require("../../implementations/dms-auth");
+const db_1 = require("@antelopejs/interface-dms/db");
+const guards_1 = require("@antelopejs/interface-dms/guards");
+const request_tenant_1 = require("@antelopejs/interface-dms/request-tenant");
+const tenant_access_1 = require("@antelopejs/interface-dms/tenant-access");
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const db_2 = require("@antelopejs/interface-dms/auth/db");
+const page_access_1 = require("../helpers/page-access");
+const TENANT = "request-guard-tenant";
+const OTHER_TENANT = "request-guard-other";
+const USER_ID = "request-guard-user";
+const MEMBER_ID = "request-guard-member";
+const AUTH_KEY = "request-guard-key";
+const HTTP_UNAUTHORIZED = 401;
+const HTTP_FORBIDDEN = 403;
+const gate = (0, page_access_1.denyingTenantGate)("request-guard-gate", TENANT);
+function context(token) {
+    return {
+        rawRequest: { headers: { authorization: `Bearer ${token}` } },
+    };
+}
+async function expectStatus(action, status) {
+    try {
+        await action();
+        chai_1.expect.fail("Expected guard rejection");
+    }
+    catch (error) {
+        (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
+        (0, chai_1.expect)(error.getStatus()).to.equal(status);
+    }
+}
+describe("[unit] request tenant guards — JWT and custom credentials", () => {
+    let user;
+    let jwt;
+    const authenticator = {
+        recognizes: (token) => token.startsWith("opaque."),
+        authenticate: async () => ({ user, tenantId: TENANT }),
+    };
+    const options = { authenticators: [authenticator] };
+    before(async () => {
+        await (0, interface_database_decorators_1.GetModel)(db_2.UserModel).insert({
+            _id: USER_ID,
+            email: "request-guard@test.local",
+            name: "Request guard",
+            authKey: AUTH_KEY,
+            isValidated: true,
+            language: "en",
+            password: null,
+        });
+        const stored = await (0, interface_database_decorators_1.GetModel)(db_2.UserModel).get(USER_ID);
+        if (!stored)
+            throw new Error("Missing guard test user");
+        user = stored;
+        jwt = (0, dms_auth_1.generateAccessToken)(TENANT, user).token;
+        await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, TENANT).insert({
+            _id: MEMBER_ID,
+            userId: USER_ID,
+            roleIds: [],
+            isTenantOwner: false,
+            joinedAt: new Date(),
+            invitedBy: null,
+        });
+    });
+    afterEach(() => {
+        tenant_access_1.internal.RegisterTenantAccessGate.unregister(gate);
+    });
+    it("preserves JWT authentication and binds its verified tenant", async () => {
+        (0, chai_1.expect)((await (0, auth_1.authenticateRequestUser)(context(jwt)))._id).to.equal(USER_ID);
+        const ctx = context(jwt);
+        (0, chai_1.expect)((await (0, guards_1.authenticateTenantRequest)(ctx))._id).to.equal(USER_ID);
+        (0, chai_1.expect)((0, request_tenant_1.getRequestTenantId)(ctx)).to.equal(TENANT);
+        (0, chai_1.expect)((await (0, guards_1.authenticateTenantRequest)(context(jwt), options))._id).to.equal(USER_ID);
+    });
+    it("rejects tampered JWT signatures and auth-key revocation", async () => {
+        const parts = jwt.split(".");
+        parts[2] = "invalid";
+        await expectStatus(() => (0, guards_1.authenticateTenantRequest)(context(parts.join("."))), HTTP_UNAUTHORIZED);
+        await (0, interface_database_decorators_1.GetModel)(db_2.UserModel).update(USER_ID, { authKey: "rotated" });
+        try {
+            await expectStatus(() => (0, guards_1.authenticateTenantRequest)(context(jwt)), HTTP_UNAUTHORIZED);
+        }
+        finally {
+            await (0, interface_database_decorators_1.GetModel)(db_2.UserModel).update(USER_ID, { authKey: AUTH_KEY });
+        }
+    });
+    it("does not enable opaque credentials on JWT-only routes", async () => {
+        await expectStatus(() => (0, guards_1.authenticateTenantRequest)(context("opaque.secret")), HTTP_UNAUTHORIZED);
+    });
+    it("does not turn successful authentication into tenant membership", async () => {
+        const foreign = {
+            ...authenticator,
+            authenticate: async () => ({ user, tenantId: OTHER_TENANT }),
+        };
+        (0, chai_1.expect)((await (0, auth_1.authenticateRequestPrincipal)(context("opaque.secret"), [foreign]))
+            .user._id).to.equal(USER_ID);
+        await expectStatus(() => (0, guards_1.authenticateTenantRequest)(context("opaque.secret"), {
+            authenticators: [foreign],
+        }), HTTP_FORBIDDEN);
+    });
+    it("requires current ownership for both credential paths", async () => {
+        for (const token of [jwt, "opaque.secret"]) {
+            await expectStatus(() => (0, guards_1.authenticateTenantRequest)(context(token), {
+                ...options,
+                requireOwner: true,
+            }), HTTP_FORBIDDEN);
+        }
+        await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, TENANT).update(MEMBER_ID, {
+            isTenantOwner: true,
+        });
+        try {
+            (0, chai_1.expect)((await (0, guards_1.authenticateTenantRequest)(context(jwt), { requireOwner: true }))
+                ._id).to.equal(USER_ID);
+            (0, chai_1.expect)((await (0, guards_1.authenticateTenantRequest)(context("opaque.secret"), {
+                ...options,
+                requireOwner: true,
+            }))._id).to.equal(USER_ID);
+        }
+        finally {
+            await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, TENANT).update(MEMBER_ID, {
+                isTenantOwner: false,
+            });
+        }
+    });
+    it("rechecks tenant gates on long-lived requests; bypass does not bypass ownership", async () => {
+        const ctx = context("opaque.secret");
+        await (0, guards_1.authenticateTenantRequest)(ctx, options);
+        (0, tenant_access_1.RegisterTenantAccessGate)(gate);
+        await expectStatus(() => (0, guards_1.authenticateTenantRequest)(ctx, options), HTTP_FORBIDDEN);
+        await expectStatus(() => (0, guards_1.authenticateTenantRequest)(context(jwt)), HTTP_FORBIDDEN);
+        (0, chai_1.expect)((await (0, guards_1.authenticateTenantRequest)(ctx, {
+            ...options,
+            bypassTenantAccessGate: true,
+        }))._id).to.equal(USER_ID);
+        await expectStatus(() => (0, guards_1.authenticateTenantRequest)(ctx, {
+            ...options,
+            requireOwner: true,
+            bypassTenantAccessGate: true,
+        }), HTTP_FORBIDDEN);
+    });
+    it("rechecks removed membership on long-lived requests", async () => {
+        const ctx = context("opaque.secret");
+        await (0, guards_1.authenticateTenantRequest)(ctx, options);
+        await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, TENANT).update(MEMBER_ID, {
+            userId: "removed-user",
+        });
+        try {
+            await expectStatus(() => (0, guards_1.authenticateTenantRequest)(ctx, options), HTTP_FORBIDDEN);
+        }
+        finally {
+            await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, TENANT).update(MEMBER_ID, {
+                userId: USER_ID,
+            });
+        }
+    });
+});
+//# sourceMappingURL=request-tenant-guards.test.js.map

package/dist/test/unit/request-tenant-guards.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-tenant-guards.test.js","sourceRoot":"","sources":["../../../src/test/unit/request-tenant-guards.test.ts"],"names":[],"mappings":";;AAAA,6DAA4E;AAC5E,6FAAqE;AACrE,+BAA8B;AAC9B,6DAAqE;AACrE,qDAAiE;AACjE,6DAA6E;AAC7E,6EAA8E;AAC9E,2EAGiD;AACjD,yDAIwC;AACxC,0DAAyE;AACzE,wDAA2D;AAE3D,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,MAAM,OAAO,GAAG,oBAAoB,CAAC;AACrC,MAAM,SAAS,GAAG,sBAAsB,CAAC;AACzC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AACrC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,IAAI,GAAG,IAAA,+BAAiB,EAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AAE7D,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO;QACL,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE;KAC5C,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAA8B,EAC9B,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;QACf,aAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAE,KAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACzE,IAAI,IAAU,CAAC;IACf,IAAI,GAAW,CAAC;IAChB,MAAM,aAAa,GAAyB;QAC1C,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAClD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACvD,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAEpD,MAAM,CAAC,KAAK,IAAI,EAAE;QAChB,MAAM,IAAA,wCAAQ,EAAC,cAAS,CAAC,CAAC,MAAM,CAAC;YAC/B,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,0BAA0B;YACjC,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAQ,EAAC,cAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxD,IAAI,GAAG,MAAM,CAAC;QACd,GAAG,GAAG,IAAA,8BAAmB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC;QAC9C,MAAM,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC;YAC/C,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE;YACX,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,IAAI,IAAI,EAAE;YACpB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,wBAAoB,CAAC,wBAAwB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,IAAA,aAAM,EAAC,CAAC,MAAM,IAAA,8BAAuB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,IAAA,aAAM,EAAC,CAAC,MAAM,IAAA,kCAAyB,EAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,IAAA,aAAM,EAAC,IAAA,mCAAkB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,IAAA,aAAM,EACJ,CAAC,MAAM,IAAA,kCAAyB,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAC7D,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;QACrB,MAAM,YAAY,CAChB,GAAG,EAAE,CAAC,IAAA,kCAAyB,EAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EACzD,iBAAiB,CAClB,CAAC;QACF,MAAM,IAAA,wCAAQ,EAAC,cAAS,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,YAAY,CAChB,GAAG,EAAE,CAAC,IAAA,kCAAyB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAC7C,iBAAiB,CAClB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,IAAA,wCAAQ,EAAC,cAAS,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,YAAY,CAChB,GAAG,EAAE,CAAC,IAAA,kCAAyB,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EACzD,iBAAiB,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,GAAyB;YACpC,GAAG,aAAa;YAChB,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;SAC7D,CAAC;QACF,IAAA,aAAM,EACJ,CAAC,MAAM,IAAA,mCAA4B,EAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;aACtE,IAAI,CAAC,GAAG,CACZ,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,EAAE,CACH,IAAA,kCAAyB,EAAC,OAAO,CAAC,eAAe,CAAC,EAAE;YAClD,cAAc,EAAE,CAAC,OAAO,CAAC;SAC1B,CAAC,EACJ,cAAc,CACf,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,CAAC;YAC3C,MAAM,YAAY,CAChB,GAAG,EAAE,CACH,IAAA,kCAAyB,EAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBACxC,GAAG,OAAO;gBACV,YAAY,EAAE,IAAI;aACnB,CAAC,EACJ,cAAc,CACf,CAAC;QACJ,CAAC;QACD,MAAM,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE;YAC1D,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,IAAA,aAAM,EACJ,CAAC,MAAM,IAAA,kCAAyB,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;iBACpE,GAAG,CACP,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpB,IAAA,aAAM,EACJ,CACE,MAAM,IAAA,kCAAyB,EAAC,OAAO,CAAC,eAAe,CAAC,EAAE;gBACxD,GAAG,OAAO;gBACV,YAAY,EAAE,IAAI;aACnB,CAAC,CACH,CAAC,GAAG,CACN,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC1D,aAAa,EAAE,KAAK;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,IAAA,kCAAyB,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAA,wCAAwB,EAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,YAAY,CAChB,GAAG,EAAE,CAAC,IAAA,kCAAyB,EAAC,GAAG,EAAE,OAAO,CAAC,EAC7C,cAAc,CACf,CAAC;QACF,MAAM,YAAY,CAChB,GAAG,EAAE,CAAC,IAAA,kCAAyB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAC7C,cAAc,CACf,CAAC;QACF,IAAA,aAAM,EACJ,CACE,MAAM,IAAA,kCAAyB,EAAC,GAAG,EAAE;YACnC,GAAG,OAAO;YACV,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CACH,CAAC,GAAG,CACN,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,EAAE,CACH,IAAA,kCAAyB,EAAC,GAAG,EAAE;YAC7B,GAAG,OAAO;YACV,YAAY,EAAE,IAAI;YAClB,sBAAsB,EAAE,IAAI;SAC7B,CAAC,EACJ,cAAc,CACf,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,IAAA,kCAAyB,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE;YAC1D,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,YAAY,CAChB,GAAG,EAAE,CAAC,IAAA,kCAAyB,EAAC,GAAG,EAAE,OAAO,CAAC,EAC7C,cAAc,CACf,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC1D,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/signup-account-guard.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/signup-account-guard.test.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const chai_1 = require("chai");
+const db_1 = require("@antelopejs/interface-dms/db");
+const signup_1 = require("../../routes/auth/signup");
+const fixtures_1 = require("../helpers/fixtures");
+const HTTP_BAD_REQUEST = 400;
+const EMAIL_TAKEN = "error.email_already_used";
+const INVALID_TOKEN = "error.invalid_token";
+const WORKSPACE_ID = "signup-guard-workspace";
+const UNKNOWN_INVITE_TOKEN = "00000000-0000-0000-0000-000000000000";
+const INVITEE_NAME = "Invitee";
+const INVITEE_PASSWORD = "InviteePassw0rd!";
+const HOLDER_NAME = "Rightful Holder";
+const HOLDER_PASSWORD = "holder-password-hash";
+const HOLDER_AUTH_KEY = "holder-auth-key";
+const USER_AGENT = "signup-guard-test";
+const IP = "127.0.0.1";
+function buildAccount(id, email, isValidated) {
+    return {
+        _id: id,
+        email,
+        name: HOLDER_NAME,
+        password: HOLDER_PASSWORD,
+        authKey: HOLDER_AUTH_KEY,
+        isValidated,
+        language: "en",
+    };
+}
+async function joinWorkspace(userId) {
+    await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, WORKSPACE_ID).insert({
+        _id: `${WORKSPACE_ID}:${userId}`,
+        userId,
+        roleIds: [],
+        isTenantOwner: false,
+        joinedAt: new Date(),
+        invitedBy: null,
+    });
+}
+async function attemptSignup(existingUser, token, claimedEmail = existingUser.email) {
+    const updatedUsers = [];
+    const userModel = {
+        getByEmail: async (lookup) => lookup === existingUser.email ? existingUser : undefined,
+        get: async () => existingUser,
+        getOwners: async () => [],
+        update: async (user) => {
+            updatedUsers.push(user);
+        },
+        insert: async () => {
+            throw new Error("signup must not create a second account");
+        },
+    };
+    try {
+        await (0, signup_1.signup)(userModel, {}, {
+            name: INVITEE_NAME,
+            email: claimedEmail,
+            password: INVITEE_PASSWORD,
+            lang: "en",
+            token,
+        }, USER_AGENT, IP);
+    }
+    catch (error) {
+        return { error, updatedUsers };
+    }
+    return { error: undefined, updatedUsers };
+}
+function expectRefusal(attempt, message) {
+    (0, chai_1.expect)(attempt.error).to.be.instanceOf(interface_api_1.HTTPResult);
+    const refusal = attempt.error;
+    (0, chai_1.expect)(refusal.getStatus()).to.equal(HTTP_BAD_REQUEST);
+    (0, chai_1.expect)(refusal.getBody()).to.equal(message);
+}
+describe("[unit] auth/signup — overwriting an existing account", () => {
+    it("refuses an unvalidated account that already belongs to a workspace", async () => {
+        const provisioned = buildAccount("signup-guard-provisioned", "provisioned@acme.dev", false);
+        await joinWorkspace(provisioned._id);
+        const { token } = await (0, fixtures_1.seedUserInvite)({ email: provisioned.email });
+        const attempt = await attemptSignup(provisioned, token);
+        expectRefusal(attempt, EMAIL_TAKEN);
+        (0, chai_1.expect)(attempt.updatedUsers).to.deep.equal([]);
+        (0, chai_1.expect)(provisioned.name).to.equal(HOLDER_NAME);
+        (0, chai_1.expect)(provisioned.password).to.equal(HOLDER_PASSWORD);
+        (0, chai_1.expect)(provisioned.authKey).to.equal(HOLDER_AUTH_KEY);
+    });
+    it("refuses the same address claimed in another case", async () => {
+        const provisioned = buildAccount("signup-guard-mixed-case", "mixed-case@acme.dev", false);
+        await joinWorkspace(provisioned._id);
+        const { token } = await (0, fixtures_1.seedUserInvite)({ email: provisioned.email });
+        const attempt = await attemptSignup(provisioned, token, "Mixed-Case@Acme.dev");
+        expectRefusal(attempt, EMAIL_TAKEN);
+        (0, chai_1.expect)(attempt.updatedUsers).to.deep.equal([]);
+    });
+    it("keeps refusing a validated account", async () => {
+        const validated = buildAccount("signup-guard-validated", "validated@acme.dev", true);
+        const { token } = await (0, fixtures_1.seedUserInvite)({ email: validated.email });
+        const attempt = await attemptSignup(validated, token);
+        expectRefusal(attempt, EMAIL_TAKEN);
+        (0, chai_1.expect)(attempt.updatedUsers).to.deep.equal([]);
+    });
+    it("still takes over a genuine draft: unvalidated and in no workspace", async () => {
+        const draft = buildAccount("signup-guard-draft", "draft@acme.dev", false);
+        const { token } = await (0, fixtures_1.seedUserInvite)({ email: draft.email });
+        const attempt = await attemptSignup(draft, token);
+        (0, chai_1.expect)(attempt.error).to.not.be.instanceOf(interface_api_1.HTTPResult);
+        (0, chai_1.expect)(attempt.updatedUsers.map((user) => user.name)).to.include(INVITEE_NAME);
+        (0, chai_1.expect)(draft.authKey).to.not.equal(HOLDER_AUTH_KEY);
+    });
+    it("stores the taken-over draft under the canonical address", async () => {
+        const draft = buildAccount("signup-guard-draft-case", "draft-case@acme.dev", false);
+        const { token } = await (0, fixtures_1.seedUserInvite)({ email: draft.email });
+        await attemptSignup(draft, token, "Draft-Case@Acme.dev");
+        (0, chai_1.expect)(draft.email).to.equal("draft-case@acme.dev");
+    });
+    it("settles the invitation before disclosing that the address is taken", async () => {
+        const provisioned = buildAccount("signup-guard-probed", "probed@acme.dev", false);
+        await joinWorkspace(provisioned._id);
+        const attempt = await attemptSignup(provisioned, UNKNOWN_INVITE_TOKEN);
+        expectRefusal(attempt, INVALID_TOKEN);
+    });
+});
+//# sourceMappingURL=signup-account-guard.test.js.map

package/dist/test/unit/signup-account-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup-account-guard.test.js","sourceRoot":"","sources":["../../../src/test/unit/signup-account-guard.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,6FAAqE;AACrE,+BAA8B;AAC9B,qDAAiE;AAMjE,qDAAkD;AAClD,kDAAqD;AAErD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAI5C,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,sCAAsC,CAAC;AACpE,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAC1C,MAAM,UAAU,GAAG,mBAAmB,CAAC;AACvC,MAAM,EAAE,GAAG,WAAW,CAAC;AAOvB,SAAS,YAAY,CAAC,EAAU,EAAE,KAAa,EAAE,WAAoB;IACnE,OAAO;QACL,GAAG,EAAE,EAAE;QACP,KAAK;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,eAAe;QACzB,OAAO,EAAE,eAAe;QACxB,WAAW;QACX,QAAQ,EAAE,IAAI;KACI,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc;IACzC,MAAM,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC;QACrD,GAAG,EAAE,GAAG,YAAY,IAAI,MAAM,EAAE;QAChC,MAAM;QACN,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,IAAI,IAAI,EAAE;QACpB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;AACL,CAAC;AAQD,KAAK,UAAU,aAAa,CAC1B,YAAkB,EAClB,KAAa,EACb,eAAuB,YAAY,CAAC,KAAK;IAEzC,MAAM,YAAY,GAAW,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG;QAGhB,UAAU,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE,CACnC,MAAM,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC1D,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;QAC7B,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QACzB,MAAM,EAAE,KAAK,EAAE,IAAU,EAAE,EAAE;YAC3B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;KACsB,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,IAAA,eAAM,EACV,SAAS,EACT,EAAkB,EAClB;YACE,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,gBAAgB;YAC1B,IAAI,EAAE,IAAI;YACV,KAAK;SACN,EACD,UAAU,EACV,EAAE,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB,EAAE,OAAe;IAC5D,IAAA,aAAM,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAmB,CAAC;IAC5C,IAAA,aAAM,EAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAA,aAAM,EAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,QAAQ,CAAC,sDAAsD,EAAE,GAAG,EAAE;IAIpE,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,WAAW,GAAG,YAAY,CAC9B,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,CACN,CAAC;QACF,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,yBAAc,EAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAExD,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpC,IAAA,aAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAKH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,WAAW,GAAG,YAAY,CAC9B,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,CACN,CAAC;QACF,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,yBAAc,EAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,WAAW,EACX,KAAK,EACL,qBAAqB,CACtB,CAAC;QAEF,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpC,IAAA,aAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,SAAS,GAAG,YAAY,CAC5B,wBAAwB,EACxB,oBAAoB,EACpB,IAAI,CACL,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,yBAAc,EAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAEtD,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpC,IAAA,aAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,YAAY,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAC1E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,yBAAc,EAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAElD,IAAA,aAAM,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAC9D,YAAY,CACb,CAAC;QACF,IAAA,aAAM,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAIH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,KAAK,GAAG,YAAY,CACxB,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,CACN,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,yBAAc,EAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAE/D,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAEzD,IAAA,aAAM,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAIH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,WAAW,GAAG,YAAY,CAC9B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,CACN,CAAC;QACF,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAEvE,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/upload-constraints.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/upload-constraints.test.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const upload_constraints_1 = require("../../utils/upload-constraints");
+describe("[unit] upload-constraints", () => {
+    describe("buildUploadConstraints", () => {
+        it("caps size and restricts mimetypes when both are configured", () => {
+            const constraints = (0, upload_constraints_1.buildUploadConstraints)({
+                maxSize: 1024,
+                allowedMimetypes: ["image/png"],
+            });
+            (0, chai_1.expect)(constraints.maxSize).to.equal(1024);
+            (0, chai_1.expect)(constraints.allowedMimetypes).to.deep.equal(["image/png"]);
+        });
+        it("omits maxSize when it is 0 (unlimited opt-out)", () => {
+            const constraints = (0, upload_constraints_1.buildUploadConstraints)({
+                maxSize: 0,
+                allowedMimetypes: [],
+            });
+            (0, chai_1.expect)(constraints.maxSize).to.equal(undefined);
+        });
+        it("omits allowedMimetypes when the list is empty", () => {
+            const constraints = (0, upload_constraints_1.buildUploadConstraints)({
+                maxSize: 1024,
+                allowedMimetypes: [],
+            });
+            (0, chai_1.expect)(constraints.allowedMimetypes).to.equal(undefined);
+        });
+    });
+    describe("isUploadValidationError", () => {
+        it("matches an error by its name across module copies", () => {
+            const error = new Error("too big");
+            error.name = "UploadValidationError";
+            (0, chai_1.expect)((0, upload_constraints_1.isUploadValidationError)(error)).to.equal(true);
+        });
+        it("rejects unrelated errors and non-errors", () => {
+            (0, chai_1.expect)((0, upload_constraints_1.isUploadValidationError)(new Error("nope"))).to.equal(false);
+            (0, chai_1.expect)((0, upload_constraints_1.isUploadValidationError)("not an error")).to.equal(false);
+            (0, chai_1.expect)((0, upload_constraints_1.isUploadValidationError)(undefined)).to.equal(false);
+        });
+    });
+});
+//# sourceMappingURL=upload-constraints.test.js.map

package/dist/test/unit/upload-constraints.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-constraints.test.js","sourceRoot":"","sources":["../../../src/test/unit/upload-constraints.test.ts"],"names":[],"mappings":";;AAAA,+BAA8B;AAC9B,uEAGwC;AAExC,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,MAAM,WAAW,GAAG,IAAA,2CAAsB,EAAC;gBACzC,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,CAAC,WAAW,CAAC;aAChC,CAAC,CAAC;YACH,IAAA,aAAM,EAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAA,aAAM,EAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,WAAW,GAAG,IAAA,2CAAsB,EAAC;gBACzC,OAAO,EAAE,CAAC;gBACV,gBAAgB,EAAE,EAAE;aACrB,CAAC,CAAC;YACH,IAAA,aAAM,EAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,WAAW,GAAG,IAAA,2CAAsB,EAAC;gBACzC,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,EAAE;aACrB,CAAC,CAAC;YACH,IAAA,aAAM,EAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,GAAG,uBAAuB,CAAC;YACrC,IAAA,aAAM,EAAC,IAAA,4CAAuB,EAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,IAAA,aAAM,EAAC,IAAA,4CAAuB,EAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnE,IAAA,aAAM,EAAC,IAAA,4CAAuB,EAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChE,IAAA,aAAM,EAAC,IAAA,4CAAuB,EAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/upload-token.test.d.ts

@@ -0,0 +1 @@
+export {};