@astralarium/repo-auth 0.1.0 → 0.2.0

package/dist/testkit/suites.js

@@ -1,47 +1,100 @@
 /** Test suites of an app's served auth: its dev build over the app's
- *  Postgres, and its production build. */
+ *  Postgres, and its production build; dev sign-in through the app. */
 import { expectViewerIndependent } from "@astralarium/repo-config-vitest/pages";
 import { withSql } from "@astralarium/repo-postgres/sql";
 import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { z } from "zod";
+import { DEV_SIGN_IN_ENDPOINT } from "../dev-sign-in/endpoint.js";
 import { shellAuth } from "../index.server.js";
 import { AUTH_BASE_PATH } from "../request.js";
 import { authorizePaths, cookieHeader, cookiePairs, expectAnonymousSession, expectAuthRateLimited, idTokenAuthorization, socialSignIn, unservedAuthPaths, verifyAuthSchema, withBlockedSessionRead } from "./index.js";
 import { jsonPost } from "./json-post.js";
-/** A throwaway email user signed up through the app at `origin` (apps
- *  with `devEmailSignIn`), deleted from `db` at `end`. */
-export function emailSession(request, {
+/** Dev sign-in through the app at `origin` as `accountId`
+ *  (`ShellAuthApp.devSignIn`): its answer. */
+export function devSignIn(request, origin, accountId) {
+  return request(`${AUTH_BASE_PATH}${DEV_SIGN_IN_ENDPOINT}`, {
+    method: "POST",
+    headers: {
+      origin,
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({
+      accountId
+    }).toString()
+  });
+}
+/** Signs in through the app's dev sign-in at `origin` as `accountId`;
+ *  rejects naming any answer other than 200. */
+export async function devSignInAs(request, origin, accountId) {
+  const response = await devSignIn(request, origin, accountId);
+  const body = await response.text();
+  if (response.status !== 200) throw new Error(`dev sign-in as ${accountId}: HTTP ${response.status} ${body}`);
+  const {
+    user
+  } = z.object({
+    user: z.object({
+      id: z.string()
+    })
+  }).parse(JSON.parse(body));
+  const setCookies = response.headers.getSetCookie();
+  return {
+    userId: user.id,
+    cookie: cookieHeader(cookiePairs(setCookies)),
+    setCookies
+  };
+}
+/** The session and user ids `cookie` carries, read past the cookie
+ *  cache. */
+export async function sessionOf(request, cookie) {
+  const response = await request(`${AUTH_BASE_PATH}/get-session?disableCookieCache=true`, {
+    headers: {
+      cookie
+    }
+  });
+  return z.object({
+    session: z.object({
+      id: z.string()
+    }),
+    user: z.object({
+      id: z.string()
+    })
+  }).parse(JSON.parse(await response.text()));
+}
+/** A session signed in through the app's dev sign-in at `origin` as a
+ *  fresh `devAccountId()` (apps with `devSignIn`); its new user is deleted
+ *  from `db` at `end`. */
+export function devSignInSession(request, {
   origin,
-  db
+  db,
+  devAccountId
 }) {
-  const email = `session-${crypto.randomUUID()}@example.test`;
+  let userId;
   return {
     async start() {
-      const response = await request(`${AUTH_BASE_PATH}/sign-up/email`, jsonPost(origin, {
-        name: "Test Session",
-        email,
-        password: "test-password-123"
-      }));
-      expect(response.status).toBe(200);
-      await response.body?.cancel();
-      const cookie = cookieHeader(cookiePairs(response.headers.getSetCookie()));
-      expect(cookie).toContain("session_token=");
-      return cookie;
+      const signedIn = await devSignInAs(request, origin, devAccountId());
+      userId = signedIn.userId;
+      return signedIn.cookie;
     },
     async end() {
+      if (!userId) return;
+      const id = userId;
       await withSql(db, async sql => {
-        await sql`DELETE FROM auth.users WHERE email = ${email}`;
+        await sql`DELETE FROM auth.users WHERE id = ${id}`;
       });
     }
   };
 }
 /**
  * Tests of `request`'s dev app serving auth over its Postgres: the database
- * role, public pages independent of the viewer, provider callbacks on
- * each local origin, and the rate limit, last: it exhausts the client's
- * budget for the window.
+ * role, public pages independent of the viewer, dev sign-in, provider
+ * callbacks on each local origin, and the rate limit, last: it exhausts
+ * the client's budget for the window. Users dev sign-in creates are
+ * deleted from `db` after.
  */
 export function testDevAuth(request, {
   session,
+  origin,
+  devAccountId,
   db,
   role,
   publicPages,
@@ -53,10 +106,24 @@ export function testDevAuth(request, {
     concurrent: false
   }, () => {
     let cookie = "";
+    /** Users dev sign-in created. */
+    const devUsers = new Set();
     beforeAll(async () => {
       cookie = await session.start();
     });
-    afterAll(() => session.end());
+    afterAll(async () => {
+      await session.end();
+      await withSql(db, async sql => {
+        await sql`DELETE FROM auth.users WHERE id = ANY(${[...devUsers]}::uuid[])`;
+      });
+    });
+    /** Signs in as `accountId`: the session's user id and the response's
+     *  `Set-Cookie` values. */
+    async function signInAs(accountId) {
+      const signedIn = await devSignInAs(request, origin, accountId);
+      devUsers.add(signedIn.userId);
+      return signedIn;
+    }
     test(`the app queries Postgres as ${role}, a non-superuser`, async () => {
       const blocked = await withBlockedSessionRead(db, () => request(`${AUTH_BASE_PATH}/get-session?disableCookieCache=true`, {
         headers: {
@@ -70,6 +137,24 @@ export function testDevAuth(request, {
       expect((await blocked.response).status).toBe(200);
     }, 15_000);
     test.each(publicPages)("the public page %s serves a signed-in visitor the anonymous visitor's document", url => expectViewerIndependent(request, url, cookie));
+    test(`dev sign-in signs in as a new ${provider} account's user with better-auth's session cookies and a signed marker naming the session`, async () => {
+      const signedIn = await signInAs(devAccountId());
+      const fresh = await sessionOf(request, signedIn.cookie);
+      expect(fresh.user.id).toBe(signedIn.userId);
+      expect(signedIn.setCookies).toContainEqual(expect.stringMatching(new RegExp(`\\.dev_sign_in=${fresh.session.id}\\.[^;]+;.*HttpOnly`, "i")));
+    });
+    test(`dev sign-in as an existing ${provider} account signs in as its user`, async () => {
+      const accountId = devAccountId();
+      const first = await signInAs(accountId);
+      const second = await signInAs(accountId);
+      expect(second.userId).toBe(first.userId);
+      expect((await sessionOf(request, second.cookie)).user.id).toBe(first.userId);
+    });
+    test("dev sign-in refuses a cross-origin request", async () => {
+      const response = await devSignIn(request, "https://elsewhere.invalid", devAccountId());
+      expect(response.status).toBe(403);
+      await response.body?.cancel();
+    });
     test.each(localOrigins.flatMap(({
       origin,
       requesters
@@ -94,8 +179,8 @@ export function testDevAuth(request, {
 }
 /**
  * Tests of `request`'s production app serving auth, against `app` built for
- * production (`devEmailSignIn` off): its schema, 404s outside the served
- * endpoints, ID-token refusal, the anonymous session, a failed provider
+ * production (`devSignIn` off): its schema, 404s outside the served
+ * endpoints and at dev sign-in, ID-token refusal, the anonymous session, a failed provider
  * callback landing on the error page, and each provider's sign-in with its
  * runtime client and callback.
  */
@@ -109,7 +194,7 @@ export function testProductionAuth(request, {
 }) {
   const production = {
     ...app,
-    devEmailSignIn: false
+    devSignIn: undefined
   };
   const auth = shellAuth(() => ({
     ...production,
@@ -131,6 +216,11 @@ export function testProductionAuth(request, {
       expect(response.status).toBe(404);
       expect(await response.text()).toBe("Not Found");
     });
+    test("the production app returns not found for dev sign-in", async () => {
+      const response = await devSignIn(request, origin, "1");
+      expect(response.status).toBe(404);
+      await response.body?.cancel();
+    });
     test.each(authorizePaths(production))("the production app refuses ID-token authorization at %s", async path => {
       const response = await request(path, idTokenAuthorization({
         origin,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astralarium/repo-auth",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "MIT",
   "homepage": "https://github.com/astralarium/repo/tree/main/packages/repo-auth#readme",
   "repository": {
@@ -9,6 +9,7 @@
     "directory": "packages/repo-auth"
   },
   "type": "module",
+  "sideEffects": false,
   "files": [
     "dist",
     "sql"
@@ -16,9 +17,13 @@
   "exports": {
     ".": "./dist/index.server.js",
     "./client": "./dist/client.js",
+    "./dev-sign-in": "./dist/dev-sign-in/index.js",
+    "./dev-sign-in/client": "./dist/dev-sign-in/client.js",
     "./providers": "./dist/providers/index.js",
     "./request": "./dist/request.js",
     "./schema": "./dist/schema.js",
+    "./start": "./dist/start/index.js",
+    "./start/server": "./dist/start/index.server.js",
     "./testkit": "./dist/testkit/index.js",
     "./testkit/suites": "./dist/testkit/suites.js"
   },
@@ -29,12 +34,14 @@
     "kysely": "^0.29.5",
     "pg": "^8.20.0",
     "zod": "^4.6.7",
-    "@astralarium/repo-env": "^0.1.0",
     "@astralarium/repo-package-files": "^0.1.0",
-    "@astralarium/repo-postgres": "^0.1.0",
-    "@astralarium/repo-telemetry": "^0.1.0"
+    "@astralarium/repo-telemetry": "^0.2.0",
+    "@astralarium/repo-postgres": "^0.2.0",
+    "@astralarium/repo-env": "^0.2.0"
   },
   "devDependencies": {
+    "@tanstack/query-core": "^5.107.1",
+    "@tanstack/react-start": "^1.169.4",
     "@types/node": "^24.2.0",
     "@types/pg": "^8.20.0",
     "@types/react": "19.2.14",
@@ -43,22 +50,27 @@
     "postgres": "^3.4.9",
     "react": "19.2.5",
     "typescript": "^6.0.3",
+    "vite": "^8.3.4",
     "vitest": "^5.0.3",
-    "@astralarium/repo-config-eslint": "^0.1.0",
     "@astralarium/repo-config-typescript": "^0.1.0",
-    "@astralarium/repo-config-vitest": "^0.1.0",
+    "@astralarium/repo-config-vitest": "^0.2.0",
+    "@astralarium/repo-config-eslint": "^0.3.0",
     "@astralarium/repo-package-build": "^0.1.0"
   },
   "peerDependencies": {
+    "@tanstack/react-start": "^1.169.4",
     "better-auth": "^1.7.7",
     "react": "^19.2.0",
     "vitest": "^5.0.3",
-    "@astralarium/repo-config-vitest": "^0.1.0"
+    "@astralarium/repo-config-vitest": "^0.2.0"
   },
   "peerDependenciesMeta": {
     "@astralarium/repo-config-vitest": {
       "optional": true
     },
+    "@tanstack/react-start": {
+      "optional": true
+    },
     "react": {
       "optional": true
     },